dump-acct - print an acct file in human-readable format.
Contents
Description
dump-acctfilename prints a list of all executed processes. This list is written by the kernel which must
be compiled with BSD process accounting enabled (Debian kernel image have it already enabled). It must be
started with accton(5). Note that on Debian systems, this is ensured via the init script
/etc/init.d/acct.
All fields are separated by vertical line. Fields are: command, version, usertime, systemtime,
effectivetime, uid, gid, memory, io, pid, ppid, time. User, system and effective times are ticks per
second. One tick is usually 1/50 of a second. The time field shows the start time of the process.
The --raw switch, as well as the --format,--byteswap, and --ahz can be used as a handy format converter.
Files
acct The system wide process accounting file. See acct(5) for further details.
Name
dump-acct - print an acct file in human-readable format.
Options
-h,--help
Prints the usage string and default locations of system files to standard output and exits.
-n,--numrecs
Number of lines to print.
-r,--reverse
Start printing from last records.
-R,--raw
Print raw records, not human-readable.
--formatversion
Use specified format version to display records.
--byteswap
Swap bytes endianness when reading records.
--ahz Use specified units of time to display data from other kernel versions and architectures.
See Also
acct(5), ac(8).
Synopsis
dump-acct [-r|--reverse] [-R|--raw] [--format] version] [--byteswap] [--ahz] hertz] [-n|--numrecs]
[-h|--help] [ files]
