The following table describes the data provided in the Daily Command Summary.
Table 20-5 Daily Command Summary
Column | Description |
|---|---|
COMMAND NAME | Name of the command. Unfortunately, all shell procedures are lumped together under the name sh because only object modules are reported by the process accounting system. You should monitor the frequency of programs called a.out or core or any other unexpected name. You can use the acctcom program to determine who executed an oddly named command and if superuser privileges were used. |
NUMBER CMDS | Total number of times this command was run during prime time. |
TOTAL KCOREMIN | Total cumulative measurement of the Kbyte segments of memory used by a process per minute of run time. |
TOTAL CPU-MIN | Total processing time this program accumulated during prime time. |
TOTAL REAL-MIN | Total real-time (wall-clock) minutes this program accumulated. |
MEAN SIZE-K | Mean of the TOTAL KCOREMIN over the number of invocations reflected by NUMBER CMDS. |
MEAN CPU-MIN | Mean derived between the NUMBER CMDS and TOTAL CPU-MIN. |
HOG FACTOR | Total CPU time divided by elapsed time. Shows the ratio of system availability to system use, providing a relative measure of total available CPU time consumed by the process during its execution. |
CHARS TRNSFD | Total number of characters pushed around by the read and write system calls. Might be negative due to overflow. |
BLOCKS READ | Total number of the physical block reads and writes that a process performed. |
Monthly Command Summary
The format of the Daily Command Summary and the Monthly Command Summary reports are virtually the same. However, the daily summary reports only on the current accounting period while the monthly summary reports on the start of the fiscal period to the current date. In other words, the monthly report is a cumulative summary that reflects the data accumulated since the last invocation of the monacct program.
Oct 16 02:30 2001 MONTHLY TOTAL COMMAND SUMMARY Page 1
TOTAL COMMAND SUMMARY
COMMAND NUMBER TOTAL TOTAL TOTAL MEAN MEAN HOG CHARS BLOCKS
NAME CMDS KCOREMIN CPU-MIN REAL-MIN SIZE-K CPU-MIN FACTOR TRNSFD READ
TOTALS 42718 4398793.50 361.92 956039.00 12154.09 0.01 0.00 16100942848 825171
netscape 789 3110437.25 121.03 79101.12 25699.58 0.15 0.00 3930527232 302486
adeptedi 84 1214419.00 50.20 4174.65 24193.62 0.60 0.01 890216640 107237
acroread 145 165297.78 7.01 18180.74 23566.84 0.05 0.00 1900504064 26053
dtmail 2 64208.90 6.35 20557.14 10112.43 3.17 0.00 250445824 43280
dtaction 800 47602.28 11.26 15.37 4226.93 0.01 0.73 640057536 8095
soffice. 13 35506.79 0.97 9.23 36510.84 0.07 0.11 134754320 5712
dtwm 2 20350.98 3.17 20557.14 6419.87 1.59 0.00 190636032 14049
|
For a description of the data provided in the Monthly Command Summary, see "Daily Command Summary ".
Last Login Report
This report gives the date when a particular login was last used. You can use this information to find unused logins and login directories that can be archived and deleted. A sample report appears follows.
Oct 16 02:30 2001 LAST LOGIN Page 1 01-06-12 kryten 01-09-08 protoA 01-10-14 ripley 01-07-14 lister 01-09-08 protoB 01-10-15 scutter1 01-08-16 pmorph 01-10-12 rimmer 01-10-16 scutter2 |
Looking at the pacct File With acctcom
At any time, you can examine the contents of the /var/adm/pacctn files, or any file with records in the acct.h format, by using the acctcom program. If you do not specify any files and do not provide any standard input when you run this command, the acctcom command reads the pacct file. Each record read by the acctcom command represents information about a terminated process. Active processes can be examined by running the ps command. The default output of the acctcom command provides the following information:
Sample acctcom output follows:
# acctcom COMMAND START END REAL CPU MEAN NAME USER TTYNAME TIME TIME (SECS) (SECS) SIZE(K) #accton root ? 02:30:01 02:30:01 0.03 0.01 304.00 turnacct adm ? 02:30:01 02:30:01 0.42 0.01 320.00 mv adm ? 02:30:01 02:30:01 0.07 0.01 504.00 utmp_upd adm ? 02:30:01 02:30:01 0.03 0.01 712.00 utmp_upd adm ? 02:30:01 02:30:01 0.01 0.01 824.00 utmp_upd adm ? 02:30:01 02:30:01 0.01 0.01 912.00 utmp_upd adm ? 02:30:01 02:30:01 0.01 0.01 920.00 utmp_upd adm ? 02:30:01 02:30:01 0.01 0.01 1136.00 utmp_upd adm ? 02:30:01 02:30:01 0.01 0.01 576.00 closewtm adm ? 02:30:01 02:30:01 0.10 0.01 664.00 |
Command name (pound (#) sign if the command was executed with superuser privileges)
User name
tty name (listed as ? if unknown)
Command starting time
Command ending time
Real time (in seconds)
CPU time (in seconds)
Mean size (in Kbytes)
You can obtain the following information by using acctcom options:
State of the fork/exec flag (1 for fork without exec)
System exit status
Hog factor
Total kcore minutes
CPU factor
Characters transferred
Blocks read
Table 20-6 acctcom Options
Option | Description |
|---|---|
-a | Shows average statistics about the processes selected. The statistics are printed after the output is recorded. |
-b
| Reads the files backward, showing latest commands first. This option has no effect if reading standard input. |
-f | Prints the fork/exec flag and system exit status columns. The output is an octal number. |
-h | Instead of mean memory size, shows the hog factor, which is the fraction of total available CPU time consumed by the process during its execution. Hog factor = total_CPU_time/elapsed_time. |
-i | Prints columns containing the I/O counts in the output. |
-k | Shows total kcore minutes instead of memory size. |
-m | Shows mean core size. This is the default. |
-q | Prints average statistics, not output records. |
-r | Shows CPU factor: user_time/(system_time + user_time). |
-t | Shows separate system and user CPU times. |
-v | Excludes column headings from the output. |
-C sec | Shows only processes with total CPU time (system plus user) exceeding sec seconds. |
-e time | Shows processes existing at or before time, given in the format hr[:min[:sec]]. |
-E time | Shows processes starting at or before time, given in the format hr[:min[:sec]]. Using the same time for both -S and -E, shows processes that existed at the time. |
-g group | Shows only processes that belong to group. |
-H factor | Shows only processes that exceed factor, where factor is the "hog factor" (see the -h option). |
-I chars | Shows only processes that transferred more characters than the cutoff number specified by chars. |
-l line | Show only processes belonging to the terminal /dev/line. |
-n pattern | Shows only commands matching pattern (a regular expression except that "+" means one or more occurrences). |
-o ofile | Instead of printing the records, copies them in acct.h format to ofile. |
-O sec | Shows only processes with CPU system time exceeding sec seconds. |
-s time | Show processes existing at or after time, given in the format hr[:min[:sec]]. |
-S time | Show processes starting at or after time, given in the format hr[:min[:sec]]. |
-u user | Shows only processes that belong to user. |