dump-acct (8)

dump-acct [\|-r\||\|--reverse\|] [\|-R\||\|--raw\|] [\|--format\|] version\|] [\|--byteswap\|] [\|--ahz\|] hertz\|] [\|-n\||\|--num recs\|] [\|-h\||\|--help\|] [\| files\|]

dump-acct filename prints a list of all executed processes. This list is written by the kernel which must be compiled with BSD process accounting enabled (Debian kernel image have it already enabled). It must be started with accton(5). Note that on Debian systems, this is ensured via the init script /etc/init.d/acct.

All fields are separated by vertical line. Fields are: command, version, user time, system time, effective time, uid, gid, memory, io, pid, ppid, time. User, system and effective times are ticks per second. One tick is usually 1/50 of a second. The time field shows the start time of the process.

The --raw switch, as well as the --format, --byteswap, and --ahz can be used as a handy format converter.

-h, --help

Prints the usage string and default locations of system files to standard output and exits.

-n, --num recs

Number of lines to print.

-r, --reverse

Start printing from last records.

-R, --raw

Print raw records, not human-readable.

--format version

Use specified format version to display records.

--byteswap

Swap bytes endianness when reading records.

--ahz

Use specified units of time to display data from other kernel versions and architectures.

acct

The system wide process accounting file. See acct(5) for further details.

acct(5), ac(8).

The GNU accounting utilities were written by Noel Cragg <[email protected]>.

This manual page was written by Ognyan Kulev <[email protected]> and updated by Daniel Baumann <[email protected]> and Mathieu Trudel <[email protected]> for the Debian project (but may be used by others).