Using system accounting

Daily Report

This report gives information about each terminal line used.

``Sample Daily Report'' shows a sample daily report.

Jun 27 09:53 1992 DAILY REPORT FOR sfxbs Page 1

from Thu Jun 26 17:45:22 1992 to Fri Jun 27 09:51:25 1992 1 runacct 1 acctcon

TOTAL DURATION IS 966 MINUTES LINE MINUTES PERCENT # SESS # ON # OFF /dev/pts/0 0 0 0 0 3 pts0000 25 3 7 4 4 console 157 16 6 3 3 TOTALS 183 -- 13 7 7

------------------------------------------------------------------------

Sample Daily Report

The from and to lines tell you the time period reflected in the report: the period from the time the last accounting report was generated until the time the current accounting report was generated. It is followed by a log of system reboots, shutdowns, power fail recoveries, and any other records dumped into /var/adm/wtmp by the acctwtmp program. See acct(1M) for more information.

The second part of the report is a breakdown of line utilization. The TOTAL DURATION tells how long the system was in multiuser state (accessible through the terminal lines). The columns are:

LINE: the terminal line or access port
MINUTES: the total number of minutes that line was in use during the accounting period
PERCENT: the total number of MINUTES the line was in use, divided into the TOTAL DURATION
# SESS: the number of times this port was accessed for a login session
# ON: This column does not have much meaning anymore. It used to list the number of times a port was used to log a user on, but because login can no longer be executed explicitly to log in a new user, this column should be identical with # SESS.
# OFF: This column reflects not just the number of times a user logs off but also any interrupts that occur on that line. Generally, interrupts occur on a port the first time ttymon is invoked after the system has been brought to multiuser state. This column is significant when the # OFF exceeds the # ON by a large factor. This usually means the multiplexor, modem, or cable is going bad, or there is a bad connection somewhere. The most common cause of this is an unconnected cable dangling from the multiplexor.

During real time, monitor /var/adm/wtmp because it is the file on which the connect accounting is based. If the wtmp file grows rapidly, execute this command:

acctcon -l file < /var/adm/wtmp

You can see which tty line is the noisiest. If the interrupting is occurring at a furious rate, general system performance will be affected.