Classic Shell Scripting

Process Accounting

Unix systems support process accounting, although it is often disabled to reduce the administrative log-file management burden. When it is enabled, on completion of each process, the kernel writes a compact binary record in a system-dependent accounting file, such as /var/adm/pacct or /var/account/pacct. The accounting file requires further processing before it can be turned into a text stream that is amenable to processing with standard tools. For example, on Sun Solaris, root might do something like this to produce a human-readable listing:

# acctcom -a                             
            List accounting records
...
COMMAND                 START    END        REAL   CPU    MEAN
NAME       USER TTYNAME TIME     TIME       (SECS) (SECS) SIZE(K)
...
cat        jones     ?  21:33:38 21:33:38   0.07   0.04 1046.00
echo       jones     ?  21:33:38 21:33:38   0.13   0.04  884.00
make       jones     ?  21:33:38 21:33:38   0.53   0.05 1048.00
grep       jones     ?  21:33:38 21:33:38   0.14   0.03  840.00
bash       jones     ?  21:33:38 21:33:38   0.55   0.02 1592.00
....

Because the output format and the accounting tools differ between Unix implementations, we cannot provide portable scripts for summarizing accounting data. However, the sample output shows that the text format is relatively simple. For example, we can easily produce a list of the top ten commands and their usage counts like this:

# acctcom -a | cut -d ' ' -f 1 | sort | uniq -c | sort -k1nr -k2 | head -n 10
21129 bash
5538 cat
4669 rm
3538 sed
1713 acomp
1378 cc
1252 cg
1252 iropt
1172 uname
 808 gawk

Here, we used cut to extract the first field, then ordered ...