acctcvt(1) acctcvt(1)
NAME
acctcvt - convert accounting data to a different format
SYNOPSIS
acctcvt [options...] [infile]
DESCRIPTION
The acctcvt command is used to convert accounting data from one format to
another. The data can come from a file or stdin (such as when used as an
audit filter) and similarly can be written to another file or stdout.
Both SGI extended accounting and standard SVR accounting formats are
supported. In addition, output can be in the form of human-readable
text, similar to that produced by sat_interpret(1M).
Some input formats may contain data records that are not related to
accounting (such as system audit information in the extended accounting
formats). These records will not be contained in the reformatted output.
However, they can be copied verbatim to stdout in case acctcvt is being
used together with other tools that may need that information. See
audit_filters(5) and the Examples section below for information on how
this might work with the System Audit Trail.
OPTIONS
-i Read input data as the second or later stage in a pipeline of audit
filters. Equivalent to specifying "--inputsource -",
"--inputformat extacct6.5", and "--inputnoheader".
-o Run in "filter" mode: all input is copied unchanged to stdout, with
the exception that a file header will be discarded. This option
cannot be specified if "--outputdestination -" was also specified.
-q Suppresses warning messages (usually concerning invalid record
types) to stderr.
-v When used with the text output format, this specifies that audit
information not related to accounting should be included in the
output. Otherwise, the option is ignored.
--filter
Same as -o.
--filterhdr
Same as --filter except that a file header (if present) from the
input source will also be copied to stdout.
--inputformat format
Specifies the format of the input data. Valid values of format are:
extacct6.2 IRIX 6.2 extended accounting format
Page 1
acctcvt(1) acctcvt(1)
extacct6.4 IRIX 6.4 extended accounting format
extacct6.5 IRIX 6.5 extended accounting format
svr4 Standard SVR4 process accounting data
The default is extacct6.5. Note that for the SAT/extended
accounting input formats, records unrelated to accounting will not
be included in the reformatted output.
--inputheader
Indicates that the input data starts with a file header. This is
the default for all input formats except svr4, for which this option
is illegal (the svr4 accounting data format does not define a file
header).
--inputnoheader
Indicates that the input data does not begin with a file header.
This would be useful if acctcvt were being used in a pipeline of
audit filters and the previous stage of the pipe discards the
header. It is also the normal behavior for the svr4 input format.
[--inputsource] { - | path }
Specifies the source from which input data should be taken. If "-"
is specified (or the option is not specified at all) data is taken
from stdin. Otherwise, the pathname of a file from which data is to
be read should be specified for path. Notice that it is not
strictly necessary to specify "--inputsource" unless the input file
begins with a "-" character; the first unrecognized command line
argument that does not begin with a "-" will be taken as the input
source.
--outputdestination { - | |cmd | path }
Specifies the destination to which reformatted output should be
written. If "-" is specified (or the option is not specified at
all) data is written to stdout. If the first character of the
destination is the character "|", then the remainder of the
destination will be taken as a command line and executed with
"/bin/sh -c"; the stdin of this second process will receive the
output from acctcvt. Note that with most shells it will be
necessary to enclose cmd in quotes, both to protect the "|"
character and so that cmd will be treated as a single argument to
acctcvt. If the destination does not begin with "|" then it is
assumed to be the name of a file to which the output data will be
written.
--outputformat format
Specifies the format of the output data. Valid values of format
are:
Page 2
acctcvt(1) acctcvt(1)
extacct6.2 IRIX 6.2 extended accounting format
extacct6.4 IRIX 6.4 extended accounting format
extacct6.5 IRIX 6.5 extended accounting format
svr4 Standard SVR4 accounting format
text Human readable text
The default output format is text.
--outputheader
Indicates that a file header appropriate to the output format should
be written before any accounting data. For the extended accounting
output formats, this would be useful when output is being sent to a
file that will later be processed by audit tools (such as
sat_interpret(1)) or other software that is expecting standard
System Audit Trail data. This option cannot be specified along with
the svr4 output format.
--outputnoheader
Indicates that no file header should be included with the
reformatted output. This is the default behavior.
In addition to these options, there are several "shorthand" versions of
some of the longer option names. These are:
short full option name
-f --output_destination
-i --input_format extacct6.5 --input_noheader --input_source -
-i62 --input_format extacct6.2
-i62nh --input_format extacct6.2 --input_noheader
-i64 --input_format extacct6.4
-i64nh --input_format extacct6.4 --input_noheader
-i65 --input_format extacct6.5
-i65nh --input_format extacct6.5 --input_noheader
-isvr4 --input_format svr4
-o --filter
-oh --filter_hdr
-o62 --output_format extacct6.2
-o62nh --output_format extacct6.2 --output_noheader
-o64 --output_format extacct6.4
-o64nh --output_format extacct6.4 --output_noheader
-o65 --output_format extacct6.5
-o65nh --output_format extacct6.5 --output_noheader
-osvr4 --output_format svr4
Page 3
acctcvt(1) acctcvt(1)
EXAMPLES
Converting IRIX 6.5 Extended Accounting Records
The format of the SAT (System Audit Trail) data stream used by extended
accounting changed between IRIX 6.2, IRIX 6.4 and IRIX 6.5. If it is
necessary to read accounting data from one version of IRIX using tools
from a different release of IRIX, acctcvt can be used to convert the data
from the format used by the one release of IRIX to the other. For
example, if the file "auditdata" contains IRIX 6.5 data, it can be
converted to IRIX 6.2 format and written to the file "acctdata" with the
following command:
acctcvt --inputformat extacct6.5 --inputsource auditdata
--outputformat extacct6.2 --outputdestination acctdata
This can also be done more tersely by taking advantage of the default
option settings and shorthand option names:
acctcvt -o62 < auditdata > acctdata
The file "acctdata" can now be used with other tools that may be
expecting the IRIX 6.2 extended accounting format.
Converting Accounting Data With Audit Filters
Some accounting software may read extended accounting records directly
from the System Audit Trail (SAT) using "audit filters" (see
audit_filters(5) for more details on this technique). Software that does
this and that was designed for an earlier release of IRIX may in many
cases still be able to run on more recent releases of IRIX by using
acctcvt as an audit filter. For example, suppose a program that was used
to process IRIX 6.2 extended accounting records was invoked by placing
its command line in the file /etc/config/satd.filter-1. In IRIX 6.5 this
same software could be used in the same way by adding acctcvt as an
additional filter that occurs before the accounting software. To do so,
the file /etc/config/satd.filter-0 could be created, containing:
acctcvt --outputformat extacct6.2
If the accounting software did not expect to see a SAT file header, the
--outputnoheader option should be used as well:
acctcvt --outputformat extacct6.2 --outputnoheader
Using acctcvt With Other Audit Filters
If the system audit facility is being used for conventional audit
purposes in addition to collecting accounting data, it may be necessary
to pass unmodified audit data on to other filters via stdout as well as
writing reformatted data to a separate output file or accounting program.
acctcvt provides the -o and -f options (or their long forms, --filter and
--outputdestination) for handling this situation. The -o option
instructs acctcvt to copy all input data (except a file header, if
present) to stdout, where it can be read by a subsequent audit filter.
Page 4
acctcvt(1) acctcvt(1)
The -f option instructs acctcvt to write the converted accounting data to
a specified file or command. Thus, a sample satd.filter-* file that
causes IRIX 6.2 accounting records to be written to the file
/var/adm/acctdata while passing unmodified audit records along to stdout
would look like this:
acctcvt -o -f /var/adm/acctdata -o62
If it is necessary to pass the reformatted data along to another program
rather than a file, acctcvt can create a "tee" in the audit filter
pipeline by starting a second command to which it passes the converted
data while still copying the unmodified audit data to stdout. To do
this, use the -f option as before, but specify the command preceded by
the character "|" instead of a filename. For example, if the
satd.filter-* file contained this:
acctcvt -o -f '|/usr/bin/myacct -i -dir /acct' -o62
then the command "/usr/bin/myacct -i -dir /acct" would be started in a
second process and it would receive IRIX 6.2-style extended accounting
records from acctcvt via stdin. In the meantime, acctcvt would still
continue to copy unmodified IRIX 6.5 audit records to stdout for use by
other filters. Notice that the command is enclosed in single quotes to
protect it from interpretation by the shell. In more complicated cases
it may be helpful to write a simple wrapper script for the second command
to avoid confusion.
Handling SVR4 Accounting Data
In addition to converting between different audit formats, acctcvt can
also convert accounting data to or from the older SVR4 "pacct" format.
The following command could be used to convert IRIX 6.5 extended
accounting records into SVR4 format, which could then be passed along to
SVR4 accounting tools like acctcom(1):
acctcvt -osvr4 -f /var/adm/pacct < /var/adm/sat9707201833
Conversely, SVR4 accounting data could be converted into SAT format for
use with tools which expect extended accounting format data (although
much of the extended accounting information will be missing):
acctcvt -isvr4 -o65 -f /usr/tmp/satacct < /var/adm/pacct
NOTES
The SVR4 accounting format contains considerably less data than SGI
extended accounting formats. When converting extended accounting data to
SVR4 format, metrics not supported by SVR4 will be discarded silently.
When converting SVR4 data to an extended accounting format, metrics not
supported by SVR4 will be reported as 0. In addition, SVR4 does not
split I/O metrics into separate counts for units read or units written.
When converting SVR4 data to extended accounting format, these combined
I/O counts will be reported simply as "read" data and the write counts
Page 5
acctcvt(1) acctcvt(1)
will be 0.
SEE ALSO
acct(1M), acctcom(1M), satd(1M), sat_interpret(1M), acct(4),
audit_filters(5), extacct(5).
Page 6