Unix SAR? 18
An Anonymous Coward asks: "This may appear to be a simple question at a first glance but I have been trying to find a solution for it for quite a while. I have been playing with different System Accounting utilities (i.e. SAR etc) and they all provide a wide range of useful information but I did not find any one that would be able to tell me the full path and the name of every process that a user runs in a Solaris machine. A loop with ps does not help because you may miss the processes that ran between each call to ps. Any one know how to extract this info? Is there a good System Accounting solution that does the trick? What is the best System Accounting solution available today?"
LKM (Score:3, Interesting)
Re:LKM (Score:1)
Ade_
/
Turn on auditing (Score:5, Funny)
Fire up yer browser, point it at the local AnswerBook2 server (or http://docs.sun.com/), and find the System Administrator Collection. Flip down to "SunSHIELD Basic Security Monitor Guide." Read about how to enable auditing.
Then tell it to record full paths, flip the switch, and watch your hard drives fill up in seconds due to the massive amount of auditing information being logged.
Process accounting (Score:5, Informative)
$ man acctprc
$ man acctcms
$ man -s 4 acct
Re:Process accounting (Score:3, Funny)
No manual entry for "enron accounting"
I just had to say it :)
Popularity Contest (Score:3, Interesting)
There has to be a way.
I seem to recall something like sacct or something that run on my 4.2 BSD flavored boxes back in the 1980s that had exactly the kind of information you desire.
It was in a research group at a university, and we didn't charge people for CPU time. [Does anyone really charge for CPU time anymore? It's gotten to be almost "too cheap to meter".]
However, it was interesting because it told you about applications that really got a lot of usage. Apart from the usual suspects like /usr/bin/ls, the accounting information showed which home-grown programs were the most popular.
A co-worker's XY plotting program ranked among the most used programs on the machine according to system accounting. That helped him gain credence in my advisor's eyes for spending time creating this tool, even though it was not directly related to our research.
Re:Popularity Contest (Score:2)
On a small scale, that's more-or-less true. However, if I'm not mistaken, you can 'buy' processing time on superc{ompute,luste}rs for computationally expensive tasks. For example, a science lab that needed lots of processing power for a few weeks (and it wasn't feasible to buy/build their own system) could 'purchase' those few weeks worth of CPU time on a big iron.
Of course, I believe that you buy 100% CPU time for X amount of time, instead of being charged a 'total accumulated usage per month' kind of thing...
10 seconds of searching, or hours of waiting on /. (Score:1)
There's a neat thing called process accounting that exists on every unix I've used.
Wow, amazing. I'm not bothering logging command line or full path, but it's not exactly difficult to do. I'd reccomend sucking that file into a database table and summing it up nightly, since it'll grow fast.
Re:10 seconds of searching, or hours of waiting on (Score:2)
532.8 days ago.
BSM (Score:1)
ln -s
will stop me watching them