Using system accounting

Daily Report

This report gives information about each terminal line used.

``Sample Daily Report'' shows a sample daily report.

Jun 27 09:53 1992  DAILY REPORT FOR sfxbs Page 1

from Thu Jun 26 17:45:22 1992 to Fri Jun 27 09:51:25 1992 1 runacct 1 acctcon

TOTAL DURATION IS 966 MINUTES LINE MINUTES PERCENT # SESS # ON # OFF /dev/pts/0 0 0 0 0 3 pts0000 25 3 7 4 4 console 157 16 6 3 3 TOTALS 183 -- 13 7 7


Sample Daily Report

The from and to lines tell you the time period reflected in the report: the period from the time the last accounting report was generated until the time the current accounting report was generated. It is followed by a log of system reboots, shutdowns, power fail recoveries, and any other records dumped into /var/adm/wtmp by the acctwtmp program. See acct(1M) for more information.

The second part of the report is a breakdown of line utilization. The TOTAL DURATION tells how long the system was in multiuser state (accessible through the terminal lines). The columns are:

the terminal line or access port

the total number of minutes that line was in use during the accounting period

the total number of MINUTES the line was in use, divided into the TOTAL DURATION

the number of times this port was accessed for a login session

# ON
This column does not have much meaning anymore. It used to list the number of times a port was used to log a user on, but because login can no longer be executed explicitly to log in a new user, this column should be identical with # SESS.

This column reflects not just the number of times a user logs off but also any interrupts that occur on that line. Generally, interrupts occur on a port the first time ttymon is invoked after the system has been brought to multiuser state. This column is significant when the # OFF exceeds the # ON by a large factor. This usually means the multiplexor, modem, or cable is going bad, or there is a bad connection somewhere. The most common cause of this is an unconnected cable dangling from the multiplexor.
During real time, monitor /var/adm/wtmp because it is the file on which the connect accounting is based. If the wtmp file grows rapidly, execute this command:

acctcon -l file < /var/adm/wtmp

You can see which tty line is the noisiest. If the interrupting is occurring at a furious rate, general system performance will be affected.

© 2004 The SCO Group, Inc. All rights reserved.
UnixWare 7 Release 7.1.4 - 22 April 2004