acctcvt(1) acctcvt(1) NAME acctcvt - convert accounting data to a different format SYNOPSIS acctcvt [options...] [infile] DESCRIPTION The acctcvt command is used to convert accounting data from one format to another. The data can come from a file or stdin (such as when used as an audit filter) and similarly can be written to another file or stdout. Both SGI extended accounting and standard SVR accounting formats are supported. In addition, output can be in ASCII text. The output can be in the form of human-readable text, either in the format similar to that produced by sat_interpret(1M) or by acctcom(1). The output can also be in the format that can be fed into a post-processing tool like awk(1). Some input formats may contain data records that are not related to accounting (such as system audit information in the extended accounting formats). These records will not be contained in the reformatted output. However, they can be copied verbatim to stdout in case acctcvt is being used together with other tools that may need that information. See audit_filters(5) and the Examples section below for information on how this might work with the System Audit Trail. OPTIONS -d Sets debug mode. -i Read input data as the second or later stage in a pipeline of audit filters. Equivalent to specifying "--input_source -", "--input_format extacct6.5", and "--input_noheader". -o Run in "filter" mode: all input is copied unchanged to stdout, with the exception that a file header will be discarded. This option cannot be specified if "--output_destination -" was also specified. -q Suppresses warning messages (usually concerning invalid record types) to stderr. -v When used with the text or text_acctcom output format, this specifies that audit information not related to accounting should be included in the output. Otherwise, the option is ignored. --filter Same as -o. --filter_hdr Same as --filter except that a file header (if present) from the input source will also be copied to stdout. --input_format format Specifies the format of the input data. Valid values of format are: extacct6.2 IRIX 6.2 extended accounting format extacct6.4 IRIX 6.4 extended accounting format extacct6.5 IRIX 6.5 extended accounting format svr4 Standard SVR4 process accounting data The default is extacct6.5. Note that for the SAT/extended accounting input formats, records unrelated to accounting will not be included in the reformatted output. --input_header Indicates that the input data starts with a file header. This is the default for all input formats except svr4, for which this option is illegal (the svr4 accounting data format does not define a file header). --input_noheader Indicates that the input data does not begin with a file header. This would be useful if acctcvt were being used in a pipeline of audit filters and the previous stage of the pipe discards the header. It is also the normal behavior for the svr4 input format. [--input_source] { - | path } Specifies the source from which input data should be taken. If "-" is specified (or the option is not specified at all) data is taken from stdin. Otherwise, the pathname of a file from which data is to be read should be specified for path. Notice that it is not strictly necessary to specify "--input_source" unless the input file begins with a "-" character; the first unrecognized command line argument that does not begin with a "-" will be taken as the input source. --output_destination { - | |cmd | path } Specifies the destination to which reformatted output should be written. If "-" is specified (or the option is not specified at all) data is written to stdout. If the first character of the destination is the character "|", then the remainder of the destination will be taken as a command line and executed with "/bin/sh -c"; the stdin of this second process will receive the output from acctcvt. Note that with most shells it will be necessary to enclose cmd in quotes, both to protect the "|" character and so that cmd will be treated as a single argument to acctcvt. If the destination does not begin with "|" then it is assumed to be the name of a file to which the output data will be written. --output_format format Specifies the format of the output data. Valid values of format are: extacct6.2 IRIX 6.2 extended accounting format extacct6.4 IRIX 6.4 extended accounting format extacct6.5 IRIX 6.5 extended accounting format svr4 Standard SVR4 accounting format text Human-readable text in row format text_acctcom Human-readable text in acctcom-like format text_awk Text in awkable format; can only be specified with extacct input format. The default output format is text. --output_header Indicates that a file header appropriate to the output format should be written before any accounting data. For the extended accounting output formats, this would be useful when output is being sent to a file that will later be processed by audit tools (such as sat_interpret(1)) or other software that is expecting standard System Audit Trail data. This option cannot be specified along with the svr4 or text_awk output format. --output_noheader Indicates that no file header should be included with the reformatted output. This is the default behavior. -A ash Selects only processes that have an array session handle that matches the ash argument. -C sec Selects only processes with total CPU time (system plus user time) exceeding sec seconds. -I chars Selects only processes that transfer more characters than the cutoff number given by chars. -M kbytes Selects only processes with mean core size exceeding kbytes KB. -n pattern Selects only commands matching pattern that may be a regular expression, as in ed(1), except that a + symbol indicates one or more occurrences. -O sec Selects only processes with CPU system time exceeding sec seconds. There are several "shorthand" versions of some of the longer option names. These are: short full option name -f --output_destination -i --input_format extacct6.5 --input_noheader --input_source - -i62 --input_format extacct6.2 -i62nh --input_format extacct6.2 --input_noheader -i64 --input_format extacct6.4 -i64nh --input_format extacct6.4 --input_noheader -i65 --input_format extacct6.5 -i65nh --input_format extacct6.5 --input_noheader -isvr4 --input_format svr4 -o --filter -oh --filter_hdr -o62 --output_format extacct6.2 -o62nh --output_format extacct6.2 --output_noheader -o64 --output_format extacct6.4 -o64nh --output_format extacct6.4 --output_noheader -o65 --output_format extacct6.5 -o65nh --output_format extacct6.5 --output_noheader -osvr4 --output_format svr4 -otext --output_format text -oacctcom --output_format text_acctcom -oawk --output_format text_awk The following options only apply to the text_acctcom output format: -a Prints array session handle; can only be specified with extacct input format. -c Prints the number of logical I/O requests; can only be specified with extacct input format. -e Prints the system exit status; can only be specified with svr4 input format. -g Prints group ID. -h Excludes column headings from the output. Options -h and -H are mutually exclusive. -H Prints column headings on every page. -io Prints columns containing the I/O counts. -k Instead of memory size, prints total kcore-minutes, which is the average resident set size of the process (in KB) if its execution time is normalized to one minute. This is computed by keeping a cumulative sum of the process's resident set size (the process's current resident set size is added to the sum HZ times a second). This sum is converted to KB and then divided by 60*HZ to yield kcore-minutes. -l Prints the tty information. -m Prints mean core size. This is average resident set size of the process (in KB) during its execution. It is computed by taking the cumulative resident set size (as computed for the -k option) and dividing it by the sum of the system and user CPU times. This is the default print option. If you do not specify any other print options, -m is selected. If you do specify other print options and you want mean core size to print, you must specify -m. -p Prints process ID and parent process ID; can only be specified with extacct input format. -P Prints project ID; can only be specified with extacct input format. -r rppage Sets the number of records per page to rppage; must be specified with the -H option. The default is 75. -s Prints the service provider information (SPI) for array session records; can only be specified with extacct input format. -t Prints separate system and user CPU times. -V Combines some I/O fields; must be specified with the -c, -io, or -w option; can only be specified with extacct input format. -w Prints wait times; can only be specified with extacct input format. The following option only applies to the text_awk output format: -fs fsep Sets the field separator to fsep. The default is a blank. The text_awk output format prints the following fields separated by a delimiter: Command name User name TTY information Start time End time Elapsed time in seconds System CPU time in seconds User CPU time in seconds Number of characters transferred Number of blocks transferred Mean core size in KB Total kcore-minutes Number of characters read Number of characters written Number of blocks read Number of blocks written Array session handle Project ID Group name Number of logical read requests Number of logical write requests Process ID Parent process ID Run queue wait time in seconds Block I/O wait time in seconds Raw I/O wait time in seconds Service provider information EXAMPLES Converting IRIX 6.5 Extended Accounting Records The format of the SAT (System Audit Trail) data stream used by extended accounting changed between IRIX 6.2, IRIX 6.4 and IRIX 6.5. If it is necessary to read accounting data from one version of IRIX using tools from a different release of IRIX, acctcvt can be used to convert the data from the format used by the one release of IRIX to the other. For example, if the file "auditdata" contains IRIX 6.5 data, it can be converted to IRIX 6.2 format and written to the file "acctdata" with the following command: acctcvt --input_format extacct6.5 --input_source auditdata --output_format extacct6.2 --output_destination acctdata This can also be done more tersely by taking advantage of the default option settings and shorthand option names: acctcvt -o62 < auditdata > acctdata The file "acctdata" can now be used with other tools that may be expecting the IRIX 6.2 extended accounting format. Converting Accounting Data With Audit Filters Some accounting software may read extended accounting records directly from the System Audit Trail (SAT) using "audit filters" (see audit_filters(5) for more details on this technique). Software that does this and that was designed for an earlier release of IRIX may in many cases still be able to run on more recent releases of IRIX by using acctcvt as an audit filter. For example, suppose a program that was used to process IRIX 6.2 extended accounting records was invoked by placing its command line in the file /etc/config/satd.filter-1. In IRIX 6.5 this same software could be used in the same way by adding acctcvt as an additional filter that occurs before the accounting software. To do so, the file /etc/config/satd.filter-0 could be created, containing: acctcvt --output_format extacct6.2 If the accounting software did not expect to see a SAT file header, the --output_noheader option should be used as well: acctcvt --output_format extacct6.2 --output_noheader Using acctcvt With Other Audit Filters If the system audit facility is being used for conventional audit purposes in addition to collecting accounting data, it may be necessary to pass unmodified audit data on to other filters via stdout as well as writing reformatted data to a separate output file or accounting program. acctcvt provides the -o and -f options (or their long forms, --filter and --output_destination) for handling this situation. The -o option instructs acctcvt to copy all input data (except a file header, if present) to stdout, where it can be read by a subsequent audit filter. The -f option instructs acctcvt to write the converted accounting data to a specified file or command. Thus, a sample satd.filter-* file that causes IRIX 6.2 accounting records to be written to the file /var/adm/acctdata while passing unmodified audit records along to stdout would look like this: acctcvt -o -f /var/adm/acctdata -o62 If it is necessary to pass the reformatted data along to another program rather than a file, acctcvt can create a "tee" in the audit filter pipeline by starting a second command to which it passes the converted data while still copying the unmodified audit data to stdout. To do this, use the -f option as before, but specify the command preceded by the character "|" instead of a filename. For example, if the satd.filter-* file contained this: acctcvt -o -f '|/usr/bin/myacct -i -dir /acct' -o62 then the command "/usr/bin/myacct -i -dir /acct" would be started in a second process and it would receive IRIX 6.2-style extended accounting records from acctcvt via stdin. In the meantime, acctcvt would still continue to copy unmodified IRIX 6.5 audit records to stdout for use by other filters. Notice that the command is enclosed in single quotes to protect it from interpretation by the shell. In more complicated cases it may be helpful to write a simple wrapper script for the second command to avoid confusion. Handling SVR4 Accounting Data In addition to converting between different audit formats, acctcvt can also convert accounting data to or from the older SVR4 "pacct" format. The following command could be used to convert IRIX 6.5 extended accounting records into SVR4 format, which could then be passed along to SVR4 accounting tools like acctcom(1): acctcvt -osvr4 -f /var/adm/pacct < /var/adm/sat_9707201833 Conversely, SVR4 accounting data could be converted into SAT format for use with tools which expect extended accounting format data (although much of the extended accounting information will be missing): acctcvt -isvr4 -o65 -f /usr/tmp/satacct < /var/adm/pacct Outputting in Text Format The following command can be used to print IRIX 6.5 extended accounting data in text_acctcom format. The output includes the I/O counts and wait times. acctcvt -oacctcom -io -w /var/adm/sat_9707201833 The following command can be used to print IRIX 6.5 extended accounting data in text_awk format, with the field separator being ",". acctcvt -oawk -fs , /var/adm/sat_9707201833 NOTES The SVR4 accounting format contains considerably less data than SGI extended accounting formats. When converting extended accounting data to SVR4 format, metrics not supported by SVR4 will be discarded silently. When converting SVR4 data to an extended accounting format, metrics not supported by SVR4 will be reported as 0. In addition, SVR4 does not split I/O metrics into separate counts for units read or units written. When converting SVR4 data to extended accounting format, these combined I/O counts will be reported simply as "read" data and the write counts will be 0. SEE ALSO acct(1M), acctcom(1), satd(1M), sat_interpret(1M), acct(4), audit_filters(5), extacct(5), awk(1), ed(1). Page 8