Hi All,
Following up on the Adam's old presentation on Linux process accounting. Does anyone know the meaning of fields in the pacct file? The utility dump-acct dumps it in a plaintext lines separated by | . Like this:
sh | 0.0| 0.0| 11.0| 0| 0|107328.0| 19284 3258|Tue Apr 26 04:17:07 2016
First three floats are runtimes, then UID|GID; last is the date it ended. Googling brought me "memory" and "io" for the two other fields but I am still at loss. What is memory here? And why io is two numbers (read/write? Which is which?)
Does anyone know? (I am trying to avoid reading the sources of dump-acct or system headers). Thanks!
On 2016-04-26 Grigory Shamov wrote:
sh | 0.0| 0.0| 11.0| 0| 0|107328.0| 19284 3258|Tue Apr 26 04:17:07 2016
First three floats are runtimes, then UID|GID; last is the date it ended. Googling brought me "memory" and "io" for the two other fields but I am still at loss. What is memory here? And why io is two numbers (read/write? Which is which?)
Man do the man pages for this whole subsystem suck!
"man 5 acct" is the closest I get to something useful. From the C struct shown, excluding the "unused" lines, I would hazard a guess that memory is "Average memory usage (kB)" and the 2 numbers aren't io but minor/major page faults. That actually jives with the numbers you provided.
You should be easily be able to confirm if it's pf's by running: time commandfoo (at least on tcsh)
My shell shows me pagefaults major+minor when I set: set time = (1 "%U+%Sc %Es %P %X+%D<%Mk | %w+%ccs %F+%Rpg %Wsw %ksg")
If the pf from time lines up with what acct says then voila.
"Average memory usage" is a bit of a weird stat, but could be handy. Maybe Adam can speak more to that.
Hi Trevor,
Thanks, man 5 acct was useful! I've also learned from it that times are in clock ticks.
-
Grigory Shamov -
Trevor Cordes