SUMMARY: system accounting

From: Dan Schlitt (
Date: Wed Jan 19 1994 - 05:59:52 CST

A while ago I asked about system accounting and I got a couple of helpful
replies along with some requests for a summary if I got anything of interest.

I haven't had much time to make use of the information that I got. As an
xmas present we got an electriacl fire which has wiped out all electrical
power to the building where the school of engineering is housed. As you
can imagine, there have been more important things to do than work on

Since on a bunch of the workstations wtmp had not been cleaned since
the machines were first started :-) I got quite a bit of historical
use information from there.

Attached are (edited) replies. Thanks to everyone who responded.


Dan Schlitt School of Engineering Computer Systems City College of New York
(212)650-6760 New York, NY 10031

My original query was:
>This was posted some time ago and I have not seen a summary. I am in need
>of this type of thing now. The Dean wants to know if and how the
>workstations are being used, etc. Right now.
>So I would like to hear about what other people do to get this type of
>Dan Schlitt School of Engineering Computer Systems
> City College of New York
>(212)650-6760 New York, NY 10031
>From: David Brown - Computer Centre <>
>Reply-To: David Brown - Computer Centre <>
>Date: Fri, 29 Oct 93 09:37:28 GMT
>Subject: System accounting
> I would like to know if anyone is aware of any s/w that can
> gather the system accounting info. of 32+ suns and produce one
> report. Also is there anything out there to show the statistics of
> a user or group of users graphically so that it can digested easily by
> my boss.
>cheers dave

Dan Stromberg - OAC/DCS repied:

I wrote something like that, when I worked at Univ of Cincinnati, for
a bunch of Sun's (and a bunch of PC's, that dumped some login info
into a log file...).

What kind of info are you looking for? Utilization? You could just
snarf /etc/wtmp (or wherever it lives), parse it up with the utmp.h
files from the relevant (*ix) architectures...

Note that they aren't guaranteed to be perfectly accurate, but with a
few heuristics (like, no-one stays logged in after a reboot, no one
logs in twice on the same tty), you can get accurate enough for most

The code I wrote isn't my property, but you may be able to convince
the new person (my former supervisor isn't there anymore) to send you
the code. You Might chose to contact about this -
or if he's still around.

Pete Welcher answered:

1) If you look thru the scripts in /usr/lib/acct, there's one outputs
accounting files in ascii form. If you look closely at the man pages
you'll then discover there's another that merges two accounting files
(it only worked for me in ascii form). You do need to sort by uid, and
there may be some bogus ones in there too. The winner is:
**acctmerg**; I'm not able to look at my script right now for more
details. Rcp or whatever the files to one machine, then use a for
(csh: foreach) loop to merge all but the first into the first (using
temporary intermediate files).

Robert J Wolf, Sun System Admin. offered:

I have a shell script and a few awk scripts that do quite a good job of
system monitoring. It can be used as standalone and/or network based.
It uses a few cron entries to start and stop the system monitoring daily.
Generate reports daily and mail the reports daily.

Reply back if you would like a copy.

This archive was generated by hypermail 2.1.2 : Fri Sep 28 2001 - 23:08:54 CDT