Process Accounting
Unix systems support process accounting, although it is
often disabled to reduce the administrative log-file management burden.
When it is enabled, on completion of each process, the kernel writes a
compact binary record in a system-dependent accounting file, such as
/var/adm/pacct
or /var/account/pacct
. The accounting file
requires further processing before it can be turned into a text stream
that is amenable to processing with standard tools. For example, on Sun
Solaris, root
might do something like
this to produce a human-readable listing:
# acctcom -a
List accounting records
...
COMMAND START END REAL CPU MEAN
NAME USER TTYNAME TIME TIME (SECS) (SECS) SIZE(K)
...
cat jones ? 21:33:38 21:33:38 0.07 0.04 1046.00
echo jones ? 21:33:38 21:33:38 0.13 0.04 884.00
make jones ? 21:33:38 21:33:38 0.53 0.05 1048.00
grep jones ? 21:33:38 21:33:38 0.14 0.03 840.00
bash jones ? 21:33:38 21:33:38 0.55 0.02 1592.00
....
Because the output format and the accounting tools differ between Unix implementations, we cannot provide portable scripts for summarizing accounting data. However, the sample output shows that the text format is relatively simple. For example, we can easily produce a list of the top ten commands and their usage counts like this:
# acctcom -a | cut -d ' ' -f 1 | sort | uniq -c | sort -k1nr -k2 | head -n 10
21129 bash
5538 cat
4669 rm
3538 sed
1713 acomp
1378 cc
1252 cg
1252 iropt
1172 uname
808 gawk
Here, we used cut to extract the first field, then ordered ...
Get Classic Shell Scripting now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.