IRIX Base Documentation 1998 November/IRIX 6.5.2 Base Documentation November 1998.img/usr/share/catman/u_man/cat1/acctcvt.z/acctcvt

Text File | 1998-10-20 | 24KB | 397 lines

aaaaccccccccttttccccvvvvtttt((((1111))))                                                          aaaaccccccccttttccccvvvvtttt((((1111))))



NNNNAAAAMMMMEEEE
     acctcvt - convert accounting data to a different format

SSSSYYYYNNNNOOOOPPPPSSSSIIIISSSS
     aaaaccccccccttttccccvvvvtttt [_o_p_t_i_o_n_s...] [_i_n_f_i_l_e]

DDDDEEEESSSSCCCCRRRRIIIIPPPPTTTTIIIIOOOONNNN
     The _a_c_c_t_c_v_t command is used to convert accounting data from one format to
     another.  The data can come from a file or stdin (such as when used as an
     audit filter) and similarly can be written to another file or stdout.
     Both SGI extended accounting and standard SVR accounting formats are
     supported.  In addition, output can be in the form of human-readable
     text, similar to that produced by _s_a_t__i_n_t_e_r_p_r_e_t(1M).

     Some input formats may contain data records that are not related to
     accounting (such as system audit information in the extended accounting
     formats).  These records will not be contained in the reformatted output.
     However, they can be copied verbatim to stdout in case _a_c_c_t_c_v_t is being
     used together with other tools that may need that information.  See
     _a_u_d_i_t__f_i_l_t_e_r_s(5) and the Examples section below for information on how
     this might work with the System Audit Trail.

OOOOPPPPTTTTIIIIOOOONNNNSSSS
     _----_iiii   Read input data as the second or later stage in a pipeline of audit
          filters.  Equivalent to specifying "_----_----_iiii_nnnn_pppp_uuuu_tttt______ssss_oooo_uuuu_rrrr_cccc_eeee _----",
          "_----_----_iiii_nnnn_pppp_uuuu_tttt______ffff_oooo_rrrr_mmmm_aaaa_tttt _eeee_xxxx_tttt_aaaa_cccc_cccc_tttt_6666_...._5555", and "_----_----_iiii_nnnn_pppp_uuuu_tttt______nnnn_oooo_hhhh_eeee_aaaa_dddd_eeee_rrrr".

     _----_oooo   Run in "filter" mode: all input is copied unchanged to stdout, with
          the exception that a file header will be discarded.  This option
          cannot be specified if "_----_----_oooo_uuuu_tttt_pppp_uuuu_tttt______dddd_eeee_ssss_tttt_iiii_nnnn_aaaa_tttt_iiii_oooo_nnnn _----" was also specified.

     _----_qqqq   Suppresses warning messages (usually concerning invalid record
          types) to stderr.

     _----_vvvv   When used with the _tttt_eeee_xxxx_tttt output format, this specifies that audit
          information not related to accounting should be included in the
          output.  Otherwise, the option is ignored.

     _----_----_ffff_iiii_llll_tttt_eeee_rrrr
          Same as _----_oooo.

     _----_----_ffff_iiii_llll_tttt_eeee_rrrr______hhhh_dddd_rrrr
          Same as _----_----_ffff_iiii_llll_tttt_eeee_rrrr except that a file header (if present) from the
          input source will also be copied to stdout.

     _----_----_iiii_nnnn_pppp_uuuu_tttt______ffff_oooo_rrrr_mmmm_aaaa_tttt _f_o_r_m_a_t
          Specifies the format of the input data.  Valid values of _f_o_r_m_a_t are:

          _eeee_xxxx_tttt_aaaa_cccc_cccc_tttt_6666_...._2222     IRIX 6.2 extended accounting format






                                                                        PPPPaaaaggggeeee 1111






aaaaccccccccttttccccvvvvtttt((((1111))))                                                          aaaaccccccccttttccccvvvvtttt((((1111))))



          _eeee_xxxx_tttt_aaaa_cccc_cccc_tttt_6666_...._4444     IRIX 6.4 extended accounting format

          _eeee_xxxx_tttt_aaaa_cccc_cccc_tttt_6666_...._5555     IRIX 6.5 extended accounting format

          _ssss_vvvv_rrrr_4444           Standard SVR4 process accounting data

          The default is _eeee_xxxx_tttt_aaaa_cccc_cccc_tttt_6666_...._5555.  Note that for the SAT/extended
          accounting input formats, records unrelated to accounting will not
          be included in the reformatted output.

     _----_----_iiii_nnnn_pppp_uuuu_tttt______hhhh_eeee_aaaa_dddd_eeee_rrrr
          Indicates that the input data starts with a file header.  This is
          the default for all input formats except _ssss_vvvv_rrrr_4444, for which this option
          is illegal (the _ssss_vvvv_rrrr_4444 accounting data format does not define a file
          header).

     _----_----_iiii_nnnn_pppp_uuuu_tttt______nnnn_oooo_hhhh_eeee_aaaa_dddd_eeee_rrrr
          Indicates that the input data does not begin with a file header.
          This would be useful if _a_c_c_t_c_v_t were being used in a pipeline of
          audit filters and the previous stage of the pipe discards the
          header.  It is also the normal behavior for the _ssss_vvvv_rrrr_4444 input format.

     [_----_----_iiii_nnnn_pppp_uuuu_tttt______ssss_oooo_uuuu_rrrr_cccc_eeee] { _---- | _p_a_t_h }
          Specifies the source from which input data should be taken.  If "_----"
          is specified (or the option is not specified at all) data is taken
          from stdin.  Otherwise, the pathname of a file from which data is to
          be read should be specified for _p_a_t_h.  Notice that it is not
          strictly necessary to specify "_----_----_iiii_nnnn_pppp_uuuu_tttt______ssss_oooo_uuuu_rrrr_cccc_eeee" unless the input file
          begins with a "-" character; the first unrecognized command line
          argument that does not begin with a "-" will be taken as the input
          source.

     _----_----_oooo_uuuu_tttt_pppp_uuuu_tttt______dddd_eeee_ssss_tttt_iiii_nnnn_aaaa_tttt_iiii_oooo_nnnn { _---- | _||||_c_m_d | _p_a_t_h }
          Specifies the destination to which reformatted output should be
          written.  If "_----" is specified (or the option is not specified at
          all) data is written to stdout.  If the first character of the
          destination is the character "_||||", then the remainder of the
          destination will be taken as a command line and executed with
          "/bin/sh -c"; the stdin of this second process will receive the
          output from _a_c_c_t_c_v_t.  Note that with most shells it will be
          necessary to enclose _c_m_d in quotes, both to protect the "|"
          character and so that _c_m_d will be treated as a single argument to
          _a_c_c_t_c_v_t.  If the destination does not begin with "|" then it is
          assumed to be the name of a file to which the output data will be
          written.

     _----_----_oooo_uuuu_tttt_pppp_uuuu_tttt______ffff_oooo_rrrr_mmmm_aaaa_tttt _f_o_r_m_a_t
          Specifies the format of the output data.  Valid values of _f_o_r_m_a_t
          are:






                                                                        PPPPaaaaggggeeee 2222






aaaaccccccccttttccccvvvvtttt((((1111))))                                                          aaaaccccccccttttccccvvvvtttt((((1111))))



          _eeee_xxxx_tttt_aaaa_cccc_cccc_tttt_6666_...._2222     IRIX 6.2 extended accounting format

          _eeee_xxxx_tttt_aaaa_cccc_cccc_tttt_6666_...._4444     IRIX 6.4 extended accounting format

          _eeee_xxxx_tttt_aaaa_cccc_cccc_tttt_6666_...._5555     IRIX 6.5 extended accounting format

          _ssss_vvvv_rrrr_4444           Standard SVR4 accounting format

          _tttt_eeee_xxxx_tttt           Human readable text

          The default output format is _tttt_eeee_xxxx_tttt.

     _----_----_oooo_uuuu_tttt_pppp_uuuu_tttt______hhhh_eeee_aaaa_dddd_eeee_rrrr
          Indicates that a file header appropriate to the output format should
          be written before any accounting data.  For the extended accounting
          output formats, this would be useful when output is being sent to a
          file that will later be processed by audit tools (such as
          _s_a_t__i_n_t_e_r_p_r_e_t(1)) or other software that is expecting standard
          System Audit Trail data.  This option cannot be specified along with
          the _ssss_vvvv_rrrr_4444 output format.

     _----_----_oooo_uuuu_tttt_pppp_uuuu_tttt______nnnn_oooo_hhhh_eeee_aaaa_dddd_eeee_rrrr
          Indicates that no file header should be included with the
          reformatted output.  This is the default behavior.

     In addition to these options, there are several "shorthand" versions of
     some of the longer option names.  These are:

          short   full option name

          _----_ffff      --output_destination
          _----_iiii      --input_format extacct6.5 --input_noheader --input_source -
          _----_iiii_6666_2222    --input_format extacct6.2
          _----_iiii_6666_2222_nnnn_hhhh  --input_format extacct6.2 --input_noheader
          _----_iiii_6666_4444    --input_format extacct6.4
          _----_iiii_6666_4444_nnnn_hhhh  --input_format extacct6.4 --input_noheader
          _----_iiii_6666_5555    --input_format extacct6.5
          _----_iiii_6666_5555_nnnn_hhhh  --input_format extacct6.5 --input_noheader
          _----_iiii_ssss_vvvv_rrrr_4444  --input_format svr4
          _----_oooo      --filter
          _----_oooo_hhhh     --filter_hdr
          _----_oooo_6666_2222    --output_format extacct6.2
          _----_oooo_6666_2222_nnnn_hhhh  --output_format extacct6.2 --output_noheader
          _----_oooo_6666_4444    --output_format extacct6.4
          _----_oooo_6666_4444_nnnn_hhhh  --output_format extacct6.4 --output_noheader
          _----_oooo_6666_5555    --output_format extacct6.5
          _----_oooo_6666_5555_nnnn_hhhh  --output_format extacct6.5 --output_noheader
          _----_oooo_ssss_vvvv_rrrr_4444  --output_format svr4







                                                                        PPPPaaaaggggeeee 3333






aaaaccccccccttttccccvvvvtttt((((1111))))                                                          aaaaccccccccttttccccvvvvtttt((((1111))))



EXAMPLES
   CCCCoooonnnnvvvveeeerrrrttttiiiinnnngggg IIIIRRRRIIIIXXXX 6666....5555 EEEExxxxtttteeeennnnddddeeeedddd AAAAccccccccoooouuuunnnnttttiiiinnnngggg RRRReeeeccccoooorrrrddddssss
     The format of the SAT (System Audit Trail) data stream used by extended
     accounting changed between IRIX 6.2, IRIX 6.4 and IRIX 6.5.  If it is
     necessary to read accounting data from one version of IRIX using tools
     from a different release of IRIX, _a_c_c_t_c_v_t can be used to convert the data
     from the format used by the one release of IRIX to the other.  For
     example, if the file "auditdata" contains IRIX 6.5 data, it can be
     converted to IRIX 6.2 format and written to the file "acctdata" with the
     following command:

         _aaaa_cccc_cccc_tttt_cccc_vvvv_tttt _----_----_iiii_nnnn_pppp_uuuu_tttt______ffff_oooo_rrrr_mmmm_aaaa_tttt _eeee_xxxx_tttt_aaaa_cccc_cccc_tttt_6666_...._5555 _----_----_iiii_nnnn_pppp_uuuu_tttt______ssss_oooo_uuuu_rrrr_cccc_eeee _aaaa_uuuu_dddd_iiii_tttt_dddd_aaaa_tttt_aaaa
                  _----_----_oooo_uuuu_tttt_pppp_uuuu_tttt______ffff_oooo_rrrr_mmmm_aaaa_tttt _eeee_xxxx_tttt_aaaa_cccc_cccc_tttt_6666_...._2222 _----_----_oooo_uuuu_tttt_pppp_uuuu_tttt______dddd_eeee_ssss_tttt_iiii_nnnn_aaaa_tttt_iiii_oooo_nnnn _aaaa_cccc_cccc_tttt_dddd_aaaa_tttt_aaaa

     This can also be done more tersely by taking advantage of the default
     option settings and shorthand option names:

         _aaaa_cccc_cccc_tttt_cccc_vvvv_tttt _----_oooo_6666_2222 _<<<< _aaaa_uuuu_dddd_iiii_tttt_dddd_aaaa_tttt_aaaa _>>>> _aaaa_cccc_cccc_tttt_dddd_aaaa_tttt_aaaa

     The file "acctdata" can now be used with other tools that may be
     expecting the IRIX 6.2 extended accounting format.

   CCCCoooonnnnvvvveeeerrrrttttiiiinnnngggg AAAAccccccccoooouuuunnnnttttiiiinnnngggg DDDDaaaattttaaaa WWWWiiiitttthhhh AAAAuuuuddddiiiitttt FFFFiiiilllltttteeeerrrrssss
     Some accounting software may read extended accounting records directly
     from the System Audit Trail (SAT) using "audit filters" (see
     _a_u_d_i_t__f_i_l_t_e_r_s(5) for more details on this technique).  Software that does
     this and that was designed for an earlier release of IRIX may in many
     cases still be able to run on more recent releases of IRIX by using
     _a_c_c_t_c_v_t as an audit filter.  For example, suppose a program that was used
     to process IRIX 6.2 extended accounting records was invoked by placing
     its command line in the file _////_eeee_tttt_cccc_////_cccc_oooo_nnnn_ffff_iiii_gggg_////_ssss_aaaa_tttt_dddd_...._ffff_iiii_llll_tttt_eeee_rrrr_----_1111.  In IRIX 6.5 this
     same software could be used in the same way by adding _a_c_c_t_c_v_t as an
     additional filter that occurs _b_e_f_o_r_e the accounting software.  To do so,
     the file _////_eeee_tttt_cccc_////_cccc_oooo_nnnn_ffff_iiii_gggg_////_ssss_aaaa_tttt_dddd_...._ffff_iiii_llll_tttt_eeee_rrrr_----_0000 could be created, containing:

         _aaaa_cccc_cccc_tttt_cccc_vvvv_tttt _----_----_oooo_uuuu_tttt_pppp_uuuu_tttt______ffff_oooo_rrrr_mmmm_aaaa_tttt _eeee_xxxx_tttt_aaaa_cccc_cccc_tttt_6666_...._2222

     If the accounting software did not expect to see a SAT file header, the
     _----_----_oooo_uuuu_tttt_pppp_uuuu_tttt______nnnn_oooo_hhhh_eeee_aaaa_dddd_eeee_rrrr option should be used as well:

         _aaaa_cccc_cccc_tttt_cccc_vvvv_tttt _----_----_oooo_uuuu_tttt_pppp_uuuu_tttt______ffff_oooo_rrrr_mmmm_aaaa_tttt _eeee_xxxx_tttt_aaaa_cccc_cccc_tttt_6666_...._2222 _----_----_oooo_uuuu_tttt_pppp_uuuu_tttt______nnnn_oooo_hhhh_eeee_aaaa_dddd_eeee_rrrr


   UUUUssssiiiinnnngggg _a_c_c_t_c_v_t WWWWiiiitttthhhh OOOOtttthhhheeeerrrr AAAAuuuuddddiiiitttt FFFFiiiilllltttteeeerrrrssss
     If the system audit facility is being used for conventional audit
     purposes in addition to collecting accounting data, it may be necessary
     to pass unmodified audit data on to other filters via stdout as well as
     writing reformatted data to a separate output file or accounting program.
     _a_c_c_t_c_v_t provides the _----_oooo and _----_ffff options (or their long forms, _----_----_ffff_iiii_llll_tttt_eeee_rrrr and
     _----_----_oooo_uuuu_tttt_pppp_uuuu_tttt______dddd_eeee_ssss_tttt_iiii_nnnn_aaaa_tttt_iiii_oooo_nnnn) for handling this situation.  The _----_oooo option
     instructs _a_c_c_t_c_v_t to copy all input data (except a file header, if
     present) to stdout, where it can be read by a subsequent audit filter.



                                                                        PPPPaaaaggggeeee 4444






aaaaccccccccttttccccvvvvtttt((((1111))))                                                          aaaaccccccccttttccccvvvvtttt((((1111))))



     The _----_ffff option instructs _a_c_c_t_c_v_t to write the converted accounting data to
     a specified file or command.  Thus, a sample _ssss_aaaa_tttt_dddd_...._ffff_iiii_llll_tttt_eeee_rrrr_----* file that
     causes IRIX 6.2 accounting records to be written to the file
     _////_vvvv_aaaa_rrrr_////_aaaa_dddd_mmmm_////_aaaa_cccc_cccc_tttt_dddd_aaaa_tttt_aaaa while passing unmodified audit records along to stdout
     would look like this:

         _aaaa_cccc_cccc_tttt_cccc_vvvv_tttt _----_oooo _----_ffff _////_vvvv_aaaa_rrrr_////_aaaa_dddd_mmmm_////_aaaa_cccc_cccc_tttt_dddd_aaaa_tttt_aaaa _----_oooo_6666_2222

     If it is necessary to pass the reformatted data along to another program
     rather than a file, _a_c_c_t_c_v_t can create a "tee" in the audit filter
     pipeline by starting a second command to which it passes the converted
     data while still copying the unmodified audit data to stdout.  To do
     this, use the _----_ffff option as before, but specify the command preceded by
     the character "|" instead of a filename.  For example, if the
     _ssss_aaaa_tttt_dddd_...._ffff_iiii_llll_tttt_eeee_rrrr_----* file contained this:

         _aaaa_cccc_cccc_tttt_cccc_vvvv_tttt _----_oooo _----_ffff _''''_||||_////_uuuu_ssss_rrrr_////_bbbb_iiii_nnnn_////_mmmm_yyyy_aaaa_cccc_cccc_tttt _----_iiii _----_dddd_iiii_rrrr _////_aaaa_cccc_cccc_tttt_'''' _----_oooo_6666_2222

     then the command "_////_uuuu_ssss_rrrr_////_bbbb_iiii_nnnn_////_mmmm_yyyy_aaaa_cccc_cccc_tttt _----_iiii _----_dddd_iiii_rrrr _////_aaaa_cccc_cccc_tttt" would be started in a
     second process and it would receive IRIX 6.2-style extended accounting
     records from _a_c_c_t_c_v_t via stdin.  In the meantime, _a_c_c_t_c_v_t would still
     continue to copy unmodified IRIX 6.5 audit records to stdout for use by
     other filters.  Notice that the command is enclosed in single quotes to
     protect it from interpretation by the shell.  In more complicated cases
     it may be helpful to write a simple wrapper script for the second command
     to avoid confusion.

   HHHHaaaannnnddddlllliiiinnnngggg SSSSVVVVRRRR4444 AAAAccccccccoooouuuunnnnttttiiiinnnngggg DDDDaaaattttaaaa
     In addition to converting between different audit formats, _a_c_c_t_c_v_t can
     also convert accounting data to or from the older SVR4 "pacct" format.
     The following command could be used to convert IRIX 6.5 extended
     accounting records into SVR4 format, which could then be passed along to
     SVR4 accounting tools like _a_c_c_t_c_o_m(1):

         _aaaa_cccc_cccc_tttt_cccc_vvvv_tttt _----_oooo_ssss_vvvv_rrrr_4444 _----_ffff _////_vvvv_aaaa_rrrr_////_aaaa_dddd_mmmm_////_pppp_aaaa_cccc_cccc_tttt _<<<< _////_vvvv_aaaa_rrrr_////_aaaa_dddd_mmmm_////_ssss_aaaa_tttt______9999_7777_0000_7777_2222_0000_1111_8888_3333_3333

     Conversely, SVR4 accounting data could be converted into SAT format for
     use with tools which expect extended accounting format data (although
     much of the extended accounting information will be missing):

         _aaaa_cccc_cccc_tttt_cccc_vvvv_tttt _----_iiii_ssss_vvvv_rrrr_4444 _----_oooo_6666_5555 _----_ffff _////_uuuu_ssss_rrrr_////_tttt_mmmm_pppp_////_ssss_aaaa_tttt_aaaa_cccc_cccc_tttt _<<<< _////_vvvv_aaaa_rrrr_////_aaaa_dddd_mmmm_////_pppp_aaaa_cccc_cccc_tttt


NNNNOOOOTTTTEEEESSSS
     The SVR4 accounting format contains considerably less data than SGI
     extended accounting formats.  When converting extended accounting data to
     SVR4 format, metrics not supported by SVR4 will be discarded silently.
     When converting SVR4 data to an extended accounting format, metrics not
     supported by SVR4 will be reported as 0.  In addition, SVR4 does not
     split I/O metrics into separate counts for units read or units written.
     When converting SVR4 data to extended accounting format, these combined
     I/O counts will be reported simply as "read" data and the write counts



                                                                        PPPPaaaaggggeeee 5555






aaaaccccccccttttccccvvvvtttt((((1111))))                                                          aaaaccccccccttttccccvvvvtttt((((1111))))



     will be 0.

SSSSEEEEEEEE AAAALLLLSSSSOOOO
     acct(1M), acctcom(1M), satd(1M), sat_interpret(1M), acct(4),
     audit_filters(5), extacct(5).


















































                                                                        PPPPaaaaggggeeee 6666