acctcvt(1)acctcvt(1)NAMEacctcvt - convert accounting data to a different format
SYNOPSISacctcvt [options...] [infile]
DESCRIPTION
The acctcvt command is used to convert accounting data from one format to
another. The data can come from a file or stdin (such as when used as an
audit filter) and similarly can be written to another file or stdout.
Both SGI extended accounting and standard SVR accounting formats are
supported.
In addition, output can be in ASCII text. The output can be in the form
of human-readable text, either in the format similar to that produced by
sat_interpret(1M) or by acctcom(1). The output can also be in the format
that can be fed into a post-processing tool like awk(1).
Some input formats may contain data records that are not related to
accounting (such as system audit information in the extended accounting
formats). These records will not be contained in the reformatted output.
However, they can be copied verbatim to stdout in case acctcvt is being
used together with other tools that may need that information. See
audit_filters(5) and the Examples section below for information on how
this might work with the System Audit Trail.
OPTIONS-d Sets debug mode.
-i Read input data as the second or later stage in a pipeline of audit
filters. Equivalent to specifying "--input_source -",
"--input_format extacct6.5", and "--input_noheader".
-o Run in "filter" mode: all input is copied unchanged to stdout, with
the exception that a file header will be discarded. This option
cannot be specified if "--output_destination -" was also specified.
-q Suppresses warning messages (usually concerning invalid record
types) to stderr.
-v When used with the text or text_acctcom output format, this
specifies that audit information not related to accounting should be
included in the output. Otherwise, the option is ignored.
--filter
Same as -o.
--filter_hdr
Same as --filter except that a file header (if present) from the
input source will also be copied to stdout.
Page 1
acctcvt(1)acctcvt(1)--input_format format
Specifies the format of the input data. Valid values of format are:
extacct6.2 IRIX 6.2 extended accounting format
extacct6.4 IRIX 6.4 extended accounting format
extacct6.5 IRIX 6.5 extended accounting format
svr4 Standard SVR4 process accounting data
The default is extacct6.5. Note that for the SAT/extended
accounting input formats, records unrelated to accounting will not
be included in the reformatted output.
--input_header
Indicates that the input data starts with a file header. This is
the default for all input formats except svr4, for which this option
is illegal (the svr4 accounting data format does not define a file
header).
--input_noheader
Indicates that the input data does not begin with a file header.
This would be useful if acctcvt were being used in a pipeline of
audit filters and the previous stage of the pipe discards the
header. It is also the normal behavior for the svr4 input format.
[--input_source] { - | path }
Specifies the source from which input data should be taken. If "-"
is specified (or the option is not specified at all) data is taken
from stdin. Otherwise, the pathname of a file from which data is to
be read should be specified for path. Notice that it is not
strictly necessary to specify "--input_source" unless the input file
begins with a "-" character; the first unrecognized command line
argument that does not begin with a "-" will be taken as the input
source.
--output_destination { - | |cmd | path }
Specifies the destination to which reformatted output should be
written. If "-" is specified (or the option is not specified at
all) data is written to stdout. If the first character of the
destination is the character "|", then the remainder of the
destination will be taken as a command line and executed with
"/bin/sh -c"; the stdin of this second process will receive the
output from acctcvt. Note that with most shells it will be
necessary to enclose cmd in quotes, both to protect the "|"
character and so that cmd will be treated as a single argument to
acctcvt. If the destination does not begin with "|" then it is
assumed to be the name of a file to which the output data will be
written.
Page 2
acctcvt(1)acctcvt(1)--output_format format
Specifies the format of the output data. Valid values of format
are:
extacct6.2 IRIX 6.2 extended accounting format
extacct6.4 IRIX 6.4 extended accounting format
extacct6.5 IRIX 6.5 extended accounting format
svr4 Standard SVR4 accounting format
text Human-readable text in row format
text_acctcom Human-readable text in acctcom-like format
text_awk Text in awkable format; can only be specified with
extacct input format.
The default output format is text.
--output_header
Indicates that a file header appropriate to the output format should
be written before any accounting data. For the extended accounting
output formats, this would be useful when output is being sent to a
file that will later be processed by audit tools (such as
sat_interpret(1)) or other software that is expecting standard
System Audit Trail data. This option cannot be specified along with
the svr4 or text_awk output format.
--output_noheader
Indicates that no file header should be included with the
reformatted output. This is the default behavior.
-A ash
Selects only processes that have an array session handle that
matches the ash argument.
-C sec
Selects only processes with total CPU time (system plus user time)
exceeding sec seconds.
-I chars
Selects only processes that transfer more characters than the cutoff
number given by chars.
-M kbytes
Selects only processes with mean core size exceeding kbytes KB.
-n pattern
Selects only commands matching pattern that may be a regular
expression, as in ed(1), except that a + symbol indicates one or
Page 3
acctcvt(1)acctcvt(1)
more occurrences.
-O sec
Selects only processes with CPU system time exceeding sec seconds.
There are several "shorthand" versions of some of the longer option
names. These are:
short full option name
-f--output_destination
-i--input_format extacct6.5 --input_noheader --input_source -
-i62--input_format extacct6.2
-i62nh--input_format extacct6.2 --input_noheader
-i64--input_format extacct6.4
-i64nh--input_format extacct6.4 --input_noheader
-i65--input_format extacct6.5
-i65nh--input_format extacct6.5 --input_noheader
-isvr4--input_format svr4
-o--filter
-oh--filter_hdr
-o62--output_format extacct6.2
-o62nh--output_format extacct6.2 --output_noheader
-o64--output_format extacct6.4
-o64nh--output_format extacct6.4 --output_noheader
-o65--output_format extacct6.5
-o65nh--output_format extacct6.5 --output_noheader
-osvr4--output_format svr4
-otext--output_format text
-oacctcom--output_format text_acctcom
-oawk--output_format text_awk
The following options only apply to the text_acctcom output format:
-a Prints array session handle; can only be specified with extacct
input format.
-c Prints the number of logical I/O requests; can only be specified
with extacct input format.
-e Prints the system exit status; can only be specified with svr4 input
format.
-g Prints group ID.
-h Excludes column headings from the output. Options -h and -H are
mutually exclusive.
Page 4
acctcvt(1)acctcvt(1)-H Prints column headings on every page.
-io Prints columns containing the I/O counts.
-k Instead of memory size, prints total kcore-minutes, which is the
average resident set size of the process (in KB) if its execution
time is normalized to one minute. This is computed by keeping a
cumulative sum of the process's resident set size (the process's
current resident set size is added to the sum HZ times a second).
This sum is converted to KB and then divided by 60*HZ to yield
kcore-minutes.
-l Prints the tty information.
-m Prints mean core size. This is average resident set size of the
process (in KB) during its execution. It is computed by taking the
cumulative resident set size (as computed for the -k option) and
dividing it by the sum of the system and user CPU times.
This is the default print option. If you do not specify any other
print options, -m is selected. If you do specify other print
options and you want mean core size to print, you must specify -m.
-p Prints process ID and parent process ID; can only be specified with
extacct input format.
-P Prints project ID; can only be specified with extacct input format.
-r rppage
Sets the number of records per page to rppage; must be specified
with the -H option. The default is 75.
-s Prints the service provider information (SPI) for array session
records; can only be specified with extacct input format.
-t Prints separate system and user CPU times.
-V Combines some I/O fields; must be specified with the -c, -io, or -w
option; can only be specified with extacct input format.
-w Prints wait times; can only be specified with extacct input format.
The following option only applies to the text_awk output format:
-fs fsep
Sets the field separator to fsep. The default is a blank.
The text_awk output format prints the following fields separated by a
delimiter:
Command name
Page 5
acctcvt(1)acctcvt(1)
User name
TTY information
Start time
End time
Elapsed time in seconds
System CPU time in seconds
User CPU time in seconds
Number of characters transferred
Number of blocks transferred
Mean core size in KB
Total kcore-minutes
Number of characters read
Number of characters written
Number of blocks read
Number of blocks written
Array session handle
Project ID
Group name
Number of logical read requests
Number of logical write requests
Process ID
Parent process ID
Run queue wait time in seconds
Block I/O wait time in seconds
Raw I/O wait time in seconds
Service provider information
EXAMPLES
Converting IRIX 6.5 Extended Accounting Records
The format of the SAT (System Audit Trail) data stream used by extended
accounting changed between IRIX 6.2, IRIX 6.4 and IRIX 6.5. If it is
necessary to read accounting data from one version of IRIX using tools
from a different release of IRIX, acctcvt can be used to convert the data
from the format used by the one release of IRIX to the other. For
example, if the file "auditdata" contains IRIX 6.5 data, it can be
converted to IRIX 6.2 format and written to the file "acctdata" with the
following command:
acctcvt--input_format extacct6.5 --input_source auditdata
--output_format extacct6.2 --output_destination acctdata
This can also be done more tersely by taking advantage of the default
option settings and shorthand option names:
acctcvt-o62 < auditdata > acctdata
The file "acctdata" can now be used with other tools that may be
expecting the IRIX 6.2 extended accounting format.
Converting Accounting Data With Audit Filters
Some accounting software may read extended accounting records directly
from the System Audit Trail (SAT) using "audit filters" (see
Page 6
acctcvt(1)acctcvt(1)audit_filters(5) for more details on this technique). Software that does
this and that was designed for an earlier release of IRIX may in many
cases still be able to run on more recent releases of IRIX by using
acctcvt as an audit filter. For example, suppose a program that was used
to process IRIX 6.2 extended accounting records was invoked by placing
its command line in the file /etc/config/satd.filter-1. In IRIX 6.5 this
same software could be used in the same way by adding acctcvt as an
additional filter that occurs before the accounting software. To do so,
the file /etc/config/satd.filter-0 could be created, containing:
acctcvt--output_format extacct6.2
If the accounting software did not expect to see a SAT file header, the
--output_noheader option should be used as well:
acctcvt--output_format extacct6.2 --output_noheader
Using acctcvt With Other Audit Filters
If the system audit facility is being used for conventional audit
purposes in addition to collecting accounting data, it may be necessary
to pass unmodified audit data on to other filters via stdout as well as
writing reformatted data to a separate output file or accounting program.
acctcvt provides the -o and -f options (or their long forms, --filter and
--output_destination) for handling this situation. The -o option
instructs acctcvt to copy all input data (except a file header, if
present) to stdout, where it can be read by a subsequent audit filter.
The -f option instructs acctcvt to write the converted accounting data to
a specified file or command. Thus, a sample satd.filter-* file that
causes IRIX 6.2 accounting records to be written to the file
/var/adm/acctdata while passing unmodified audit records along to stdout
would look like this:
acctcvt-o -f /var/adm/acctdata -o62
If it is necessary to pass the reformatted data along to another program
rather than a file, acctcvt can create a "tee" in the audit filter
pipeline by starting a second command to which it passes the converted
data while still copying the unmodified audit data to stdout. To do
this, use the -f option as before, but specify the command preceded by
the character "|" instead of a filename. For example, if the
satd.filter-* file contained this:
acctcvt-o -f '|/usr/bin/myacct -i -dir /acct' -o62
then the command "/usr/bin/myacct -i -dir /acct" would be started in a
second process and it would receive IRIX 6.2-style extended accounting
records from acctcvt via stdin. In the meantime, acctcvt would still
continue to copy unmodified IRIX 6.5 audit records to stdout for use by
other filters. Notice that the command is enclosed in single quotes to
protect it from interpretation by the shell. In more complicated cases
it may be helpful to write a simple wrapper script for the second command
Page 7
acctcvt(1)acctcvt(1)
to avoid confusion.
Handling SVR4 Accounting Data
In addition to converting between different audit formats, acctcvt can
also convert accounting data to or from the older SVR4 "pacct" format.
The following command could be used to convert IRIX 6.5 extended
accounting records into SVR4 format, which could then be passed along to
SVR4 accounting tools like acctcom(1):
acctcvt-osvr4 -f /var/adm/pacct < /var/adm/sat_9707201833
Conversely, SVR4 accounting data could be converted into SAT format for
use with tools which expect extended accounting format data (although
much of the extended accounting information will be missing):
acctcvt-isvr4 -o65 -f /usr/tmp/satacct < /var/adm/pacct
Outputting in Text Format
The following command can be used to print IRIX 6.5 extended accounting
data in text_acctcom format. The output includes the I/O counts and wait
times.
acctcvt-oacctcom -io -w /var/adm/sat_9707201833
The following command can be used to print IRIX 6.5 extended accounting
data in text_awk format, with the field separator being ",".
acctcvt-oawk -fs , /var/adm/sat_9707201833
NOTES
The SVR4 accounting format contains considerably less data than SGI
extended accounting formats. When converting extended accounting data to
SVR4 format, metrics not supported by SVR4 will be discarded silently.
When converting SVR4 data to an extended accounting format, metrics not
supported by SVR4 will be reported as 0. In addition, SVR4 does not
split I/O metrics into separate counts for units read or units written.
When converting SVR4 data to extended accounting format, these combined
I/O counts will be reported simply as "read" data and the write counts
will be 0.
SEE ALSOacct(1M), acctcom(1), satd(1M), sat_interpret(1M), acct(4),
audit_filters(5), extacct(5), awk(1), ed(1).
Page 8
