File: //usr/share/doc/acct/html/Preface.html
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<!-- Created by GNU Texinfo 6.8, https://www.gnu.org/software/texinfo/ -->
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Preface (Accounting Utilities Manual)</title>
<meta name="description" content="Preface (Accounting Utilities Manual)">
<meta name="keywords" content="Preface (Accounting Utilities Manual)">
<meta name="resource-type" content="document">
<meta name="distribution" content="global">
<meta name="Generator" content="makeinfo">
<meta name="viewport" content="width=device-width,initial-scale=1">
<link href="index.html" rel="start" title="Top">
<link href="index.html#SEC_Contents" rel="contents" title="Table of Contents">
<link href="index.html" rel="up" title="Top">
<link href="ac.html" rel="next" title="ac">
<link href="index.html" rel="prev" title="Top">
<style type="text/css">
<!--
a.copiable-anchor {visibility: hidden; text-decoration: none; line-height: 0em}
a.summary-letter {text-decoration: none}
blockquote.indentedblock {margin-right: 0em}
div.display {margin-left: 3.2em}
div.example {margin-left: 3.2em}
kbd {font-style: oblique}
pre.display {font-family: inherit}
pre.format {font-family: inherit}
pre.menu-comment {font-family: serif}
pre.menu-preformatted {font-family: serif}
span.nolinebreak {white-space: nowrap}
span.roman {font-family: initial; font-weight: normal}
span.sansserif {font-family: sans-serif; font-weight: normal}
span:hover a.copiable-anchor {visibility: visible}
ul.no-bullet {list-style: none}
-->
</style>
</head>
<body lang="en">
<div class="unnumbered" id="Preface">
<div class="header">
<p>
Next: <a href="ac.html" accesskey="n" rel="next"><code>ac</code></a>, Previous: <a href="index.html" accesskey="p" rel="prev">Top</a>, Up: <a href="index.html" accesskey="u" rel="up">Top</a> [<a href="index.html#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
</div>
<hr>
<span id="Preface-1"></span><h2 class="unnumbered">Preface</h2>
<p>Way back a long time ago, Thompson and Ritchie were sitting opposite one
another at the commissary, sipping coffees and discussing their evolving
behemoth.
</p>
<p>“This behemoth of ours,” said Ken, “is becoming rather popular,
wouldn’t you say?” “Yes,” said Dennis. “Every time I want to do a
compilation, I have to wait for hours and hours. It’s infuriating.”
They both agreed that the load on their system was too great. Both
sighed, picked up their mugs, and went back to the workbench. Little
did they know that an upper-management type was sitting just within
earshot of their conversation.
</p>
<p>“We are AT&T Bell Laboratories, aren’t we?” the upper-management type
thought to himself. “Well, what is our organization best known for?”
The brill-cream in his hair glistened. “Screwing people out of lots of
money, of course! If there were some way that we could keep tabs on
users and charge them through the nose for their CPU time...”
</p>
<p>The accounting utilities were born.
</p>
<p>Seriously though, the accouting utilities can provide a system
administrator with useful information about system usage—connections,
programs executed, and utilization of system resources.
</p>
<p>Information about users—their connect time, location, programs
executed, and the like—is automatically recored in files by
<code>init</code> and <code>login</code>. Four of them are of interest to us:
<code>wtmp</code>, which has records for each login and logout;
<code>acct</code>, which records each command that was run;
<code>usracct</code> and <code>savacct</code>, which contain
summaries of the information in <code>acct</code> by user and
command, respectively. Each of the accounting utilities reports or
summarizes information stored in these files.
</p>
<dl compact="compact">
<dt><span><code>ac</code></span></dt>
<dd><p>prints statistics about users’ connect time. <code>ac</code> can tell you how
long a particular user or group of users were connected to your system,
printing totals by day or for all of the entries in the
<code>wtmp</code> file.
</p>
</dd>
<dt><span><code>accton</code></span></dt>
<dd><p>turns accounting on or off.
</p>
</dd>
<dt><span><code>lastcomm</code></span></dt>
<dd><p>lists the commands executed on the system, most recent first, showing
the run state of each command. With <code>last</code>, you can search the
<code>acct</code> file for a particular user, terminal, or command.
</p>
</dd>
<dt><span><code>sa</code></span></dt>
<dd><p>summarizes the information in the <code>acct</code> file into the
<code>savacct</code> and <code>usracct</code> file. It also
generates reports about commands, giving the number of invocations, cpu
time used, average core usage, etc.
</p>
</dd>
<dt><span><code>dump-acct</code></span></dt>
<dt><span><code>dump-utmp</code></span></dt>
<dd><p>display <code>acct</code> and <code>utmp</code> files in a human-readable format.
</p>
</dd>
</dl>
<p>For more detailed information on any of these programs, check the
chapter with the program title.
</p>
<ul class="section-toc">
<li><a href="#A-Note-on-File-Names-and-Locations" accesskey="1">A Note on File Names and Locations</a></li>
<li><a href="#Support-for-Multiple-Accounting-File-Formats-under-Linux" accesskey="2">Support for Multiple Accounting File Formats under Linux</a></li>
<li><a href="#History-of-the-Accounting-Utilities" accesskey="3">History of the Accounting Utilities</a></li>
</ul>
<div class="unnumberedsec" id="A-Note-on-File-Names-and-Locations">
<h3 class="unnumberedsec">A Note on File Names and Locations</h3>
<p>The <code>wtmp</code> and <code>acct</code> files seem to live in different places
and have different names for every variant of u*x that exists. The name
<code>wtmp</code> seems to be standard for the login accounting file, but the
process accounting file might be <code>acct</code> or <code>pacct</code> on your
system. To find the actual locations and names of these files on your
system, specify the <code>--help</code> flag to any of the programs in this
package and the information will dumped to standard output.
</p>
<p>Regardless of the names and locations of files on your system, this
manual will refer to the login accounting file as <code>wtmp</code> and the
process accounting files as <code>acct</code>, <code>savacct</code>, and
<code>usracct</code>.
</p>
</div>
<div class="unnumberedsec" id="Support-for-Multiple-Accounting-File-Formats-under-Linux">
<h3 class="unnumberedsec">Support for Multiple Accounting File Formats under Linux</h3>
<p>The detailed format of the <code>acct</code> file written by the Linux kernel
varies depending on the kernel’s version and configuration:
Linux kernels 2.6.7 and earlier write a v0 format <code>acct</code> file
which unfortunately cannot store user and group ids (<code>uid</code>/<code>gid</code>)
larger than 65535.
Kernels 2.6.8 and later write the <code>acct</code> file in v1, v2 or v3 formats.
(v3 if <code>BSD_PROCESS_ACCT_V3</code> is selected in the kernel configuration,
otherwise v1 if on the m68k architecture or v2 everywhere else).
</p>
<p>Since version 6.4 the GNU accounting utilities on Linux systems are
able to read all of the v0, v2 and v3 file formats (v1 is not supported).
Thus you do not need to worry about the details given above. You can even
read <code>acct</code> files where different records were written by differently
configured kernels (you can find out about the format of each entry by
using the <code>dump-acct</code> utility). In case you ever need to convert
an <code>acct</code> file to a different format, the <code>--raw</code> option of
<code>dump-acct</code> does that together with the new <code>--format</code> and
<code>--byteswap</code> options that determine format and byte order of the
output file.
</p>
<p>Multiformat support under Linux is intended to be a temporary solution
to aid in switching to the v3 <code>acct</code> file format. So do not expect
GNU acct 6.7 to still contain Multiformat support. In a few years
time, when everybody uses the v3 format, the ability to read multiple
formats at runtime will probably be dropped again from the GNU accounting
utilities.
This does not, however, affect the ability to adapt to the <code>acct</code> file
format at compile time (when <code>./configure</code> is run). Even GNU acct 6.3.5
(that does not know about multiple file formats) will yield working binary
programs when compiled under a (as yet hypothetical) Linux kernel 2.6.62
that is only able to write the v3 format.
</p>
</div>
<div class="unnumberedsec" id="History-of-the-Accounting-Utilities">
<h3 class="unnumberedsec">History of the Accounting Utilities</h3>
<p>I don’t have any idea who originally wrote these utilities. If anybody
does, please send some mail to <code>noel@gnu.ai.mit.edu</code> and I’ll add
your information here!
</p>
<p>Since the first alpha versions of this software in late 1993, many
people have contributed to the package. They are (in alphabetical
order):
</p>
<dl compact="compact">
<dt><span><code>Eric Backus <ericb@lsid.hp.com></code></span></dt>
<dd><p>Suggested fixes for HP-UX 9.05 using /bin/cc: configure assumed you were
using <code>gcc</code> and tacked on <code>-Wall</code> etc. He also noticed that
<code>file_rd.c</code> was doing pointer arithmetic on a <code>void *</code> pointer
(non-ANSI).
</p>
</dd>
<dt><span><code>Christoph Badura <bad@flatlin.ka.sub.org></code></span></dt>
<dd><p>Christoph was a BIG HELP in computing statistics, most notably k*sec
stuff! He also did Xenix testing and contributed some Makefile fixes
and output optimizations.
</p>
</dd>
<dt><span><code>Michael Calwas <calwas@ttd.teradyne.com></code></span></dt>
<dd><p>Fixed bugs in mktime.c.
</p>
</dd>
<dt><span><code>Derek Clegg <dclegg@apple.com></code></span></dt>
<dd><p>Suggested the simple, elegant fix for *_rd_never_used brain-damage.
</p>
</dd>
<dt><span><code>Alan Cox <iiitac@pyr.swan.ac.uk></code></span></dt>
<dd><p>Original Linux kernel accounting patches.
</p>
</dd>
<dt><span><code>Scott Crosby <root@hypercube.res.cmu.edu></code></span></dt>
<dd><p>Suggested idea behind <code>--sort-real-time</code> for <code>sa</code>.
</p>
</dd>
<dt><span><code>Solar Designer <solar@false.com></code></span></dt>
<dd><p>Added code for <code>--ahz</code> flag in <code>lastcomm</code> and <code>sa</code>.
</p>
</dd>
<dt><span><code>Dirk Eddelbuettel <edd@miles.econ.queensu.ca></code></span></dt>
<dd><p>Managed bug-fixes & etc. for Debian distribution, as well as the
architect of merge of GNU + Debian distributions. A big thanks to Dirk
for kicking me back into gear again after a long period of no work on
this project.
</p>
</dd>
<dt><span><code>Jason Grant <jamalcol@pc-5530.bc.rogers.wave.ca></code></span></dt>
<dd><p>Identified a buffer-overrun bug in <code>sa</code>.
</p>
</dd>
<dt><span><code>Kaveh R. Ghazi <ghazi@caip.rutgers.edu></code></span></dt>
<dd><p>Tested the package on many systems with compilers other than gcc. Fixed
K&R C support.
</p>
</dd>
<dt><span><code>Susan Kleinmann <sgk@sgk.tiac.net></code></span></dt>
<dd><p>Contributed excellent man pages!
</p>
</dd>
<dt><span><code>Alexander Kourakos <Alexander@Kourakos.com></code></span></dt>
<dd><p>Inspired the <code>--wide</code> option for <code>last</code>.
</p>
</dd>
<dt><span><code>Marek Michalkiewicz <marekm@i17linuxb.ists.pwr.wroc.pl></code></span></dt>
<dd><p>Suggested the <code>--ip-address</code> flag for <code>last</code>.
</p>
</dd>
<dt><span><code>David S. Miller <davem@caip.rutgers.edu></code></span></dt>
<dd><p>Noticed missing GNU-standard makefile rules.
</p>
</dd>
<dt><span><code>Walter Mueller <walt@pi4.informatik.uni-mannheim.de></code></span></dt>
<dd><p>Noticed install target was missing, and corrected a typo for prefix in
Makefile.in.
</p>
</dd>
<dt><span><code>Ian Murdock <imurdock@gnu.ai.mit.edu></code></span></dt>
<dd><p>Tracked down miscellaneous bugs in sa.c under Linux. Added Debian
package maintenance files.
</p>
</dd>
<dt><span><code>Tuomo Pyhala <tuomo@lesti.kpnet.fi></code></span></dt>
<dd><p>Reported buggy <code>--strict-match</code> flag in <code>lastcomm</code>.
</p>
</dd>
<dt><span><code>Tim Schmielau <tim@physik3.uni-rostock.de></code></span></dt>
<dd><p>Added Linux multiformat support.
</p>
</dd>
<dt><span><code>Luc I. Suryo <root@patriots.nl.mugnet.org></code></span></dt>
<dd><p>Suggested the <code>--user</code> flag for <code>lastcomm</code>.
</p>
</dd>
<dt><span><code>Pedro A M Vazquez <vazquez@iqm.unicamp.br></code></span></dt>
<dd><p>Fixed bugs in sa.c and tested under FreeBSD.
</p>
</dd>
<dt><span><code>Marco van Wieringen <Marco.van.Wieringen@mcs.nl.mugnet.org></code></span></dt>
<dd><p>Modified (wrote?) Linux kernel accounting patches.
</p></dd>
</dl>
</div>
</div>
<hr>
<div class="header">
<p>
Next: <a href="ac.html"><code>ac</code></a>, Previous: <a href="index.html">Top</a>, Up: <a href="index.html">Top</a> [<a href="index.html#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
</div>
</body>
</html>