[clug] Q: Linux process accounting?

[Alex Satrapa]

I've install the GNU accounting tools to try to take advantage of the  
BSD accounting that I've already got compiled into my kernel. After  
some period of time, I ran the following command and got a bunch of  
output, a selection of which follows:

franklin:/usr/share/doc/acct# sa --list-all-names --sort-sys-user-div- 
calls
      414  103886.77re       0.23cp         0avio      1374k
        3   12490.00re       0.13cp         0avio     10364k    
amavisd-new*
        1       0.95re       0.01cp         0avio      2466k   frontend
        1      22.55re       0.00cp         0avio       830k   apt-get
        2    1000.27re       0.00cp         0avio      1741k   perl
        2       0.27re       0.00cp         0avio       938k    
ctl_cyrusdb
       10       0.78re       0.01cp         0avio      1795k   amavis- 
stats
        6    2608.53re       0.00cp         0avio      2043k   lmtpd
       13    3220.93re       0.01cp         0avio      1679k   cleanup
       12    9479.47re       0.01cp         0avio      1798k   smtpd
       54   47830.43re       0.02cp         0avio      1639k   imapd

As you might guess, this machine is the mail server (SMTP, IMAP)  
running Postfix with Amavisd-new configured as the virus/spam catcher.

Can anyone tell me what that first line is? My guess is that it's  
either an idle time counter or a total active time counter.

With amavisd-new and imapd consuming so many real seconds for so few  
processor seconds, would this imply that it's waiting a long time for  
data to arrive through the network or disk? (even though the average  
number of I/O calls over the three processes is 0)

Does the prevalence of 0 in the average I/O calls column indicate  
that there is something fundamentally wrong with my kernel/accounting  
tools?

Is there any more documentation out there on how to use the  
accounting tools, since all I've found so far is a "HOWTO" on how to  
set up the accounting tools (which is no more than "get the tarball,  
unpack it, run ./configure, make, make install")?

I really want to know what my machine is doing when I'm not around.  
Call me the paranoid parent, but I want it to keep a detailed  
personal journal so I can snoop into its private life.

Alex Satrapa             M: +61 4 0770 5332
grail at goldweb.com.au     W: http://homepage.mac.com/alexsatrapa