acctcvt(1)
acctcvt - convert accounting data to a different format
As shipped in IRIX 6.5. First release of IRIX 6.5.
NAME acctcvt - convert accounting data to a different format SYNOPSIS acctcvt [options...] [infile] DESCRIPTION The acctcvt command is used to convert accounting data from one format to another. The data can come from a file or stdin (such as when used as an audit filter) and similarly can be written to another file or stdout. Both SGI extended accounting and standard SVR accounting formats are supported. In addition, output can be in the form of human-readable text, similar to that produced by sat_interpret(1M). Some input formats may contain data records that are not related to accounting (such as system audit information in the extended accounting formats). These records will not be contained in the reformatted output. However, they can be copied verbatim to stdout in case acctcvt is being used together with other tools that may need that information. See audit_filters(5) and the Examples section below for information on how this might work with the System Audit Trail. OPTIONS -i Read input data as the second or later stage in a pipeline of audit filters. Equivalent to specifying "--input_source -", "--input_format extacct6.5", and "--input_noheader". -o Run in "filter" mode: all input is copied unchanged to stdout, with the exception that a file header will be discarded. This option cannot be specified if "--output_destination -" was also specified. -q Suppresses warning messages (usually concerning invalid record types) to stderr. -v When used with the text output format, this specifies that audit information not related to accounting should be included in the output. Otherwise, the option is ignored. --filter Same as -o. --filter_hdr Same as --filter except that a file header (if present) from the input source will also be copied to stdout. --input_format format Specifies the format of the input data. Valid values of format are: extacct6.2 IRIX 6.2 extended accounting format extacct6.4 IRIX 6.4 extended accounting format extacct6.5 IRIX 6.5 extended accounting format svr4 Standard SVR4 process accounting data The default is extacct6.5. Note that for the SAT/extended accounting input formats, records unrelated to accounting will not be included in the reformatted output. --input_header Indicates that the input data starts with a file header. This is the default for all input formats except svr4, for which this option is illegal (the svr4 accounting data format does not define a file header). --input_noheader Indicates that the input data does not begin with a file header. This would be useful if acctcvt were being used in a pipeline of audit filters and the previous stage of the pipe discards the header. It is also the normal behavior for the svr4 input format. [--input_source] { - | path } Specifies the source from which input data should be taken. If "-" is specified (or the option is not specified at all) data is taken from stdin. Otherwise, the pathname of a file from which data is to be read should be specified for path. Notice that it is not strictly necessary to specify "--input_source" unless the input file begins with a "-" character; the first unrecognized command line argument that does not begin with a "-" will be taken as the input source. --output_destination { - | |cmd | path } Specifies the destination to which reformatted output should be written. If "-" is specified (or the option is not specified at all) data is written to stdout. If the first character of the destination is the character "|", then the remainder of the destination will be taken as a command line and executed with "/bin/sh -c"; the stdin of this second process will receive the output from acctcvt. Note that with most shells it will be necessary to enclose cmd in quotes, both to protect the "|" character and so that cmd will be treated as a single argument to acctcvt. If the destination does not begin with "|" then it is assumed to be the name of a file to which the output data will be written. --output_format format Specifies the format of the output data. Valid values of format are: extacct6.2 IRIX 6.2 extended accounting format extacct6.4 IRIX 6.4 extended accounting format extacct6.5 IRIX 6.5 extended accounting format svr4 Standard SVR4 accounting format text Human readable text The default output format is text. --output_header Indicates that a file header appropriate to the output format should be written before any accounting data. For the extended accounting output formats, this would be useful when output is being sent to a file that will later be processed by audit tools (such as sat_interpret(1)) or other software that is expecting standard System Audit Trail data. This option cannot be specified along with the svr4 output format. --output_noheader Indicates that no file header should be included with the reformatted output. This is the default behavior. In addition to these options, there are several "shorthand" versions of some of the longer option names. These are: short full option name -f --output_destination -i --input_format extacct6.5 --input_noheader --input_source - -i62 --input_format extacct6.2 -i62nh --input_format extacct6.2 --input_noheader -i64 --input_format extacct6.4 -i64nh --input_format extacct6.4 --input_noheader -i65 --input_format extacct6.5 -i65nh --input_format extacct6.5 --input_noheader -isvr4 --input_format svr4 -o --filter -oh --filter_hdr -o62 --output_format extacct6.2 -o62nh --output_format extacct6.2 --output_noheader -o64 --output_format extacct6.4 -o64nh --output_format extacct6.4 --output_noheader -o65 --output_format extacct6.5 -o65nh --output_format extacct6.5 --output_noheader -osvr4 --output_format svr4 EXAMPLES Converting IRIX 6.5 Extended Accounting Records The format of the SAT (System Audit Trail) data stream used by extended accounting changed between IRIX 6.2, IRIX 6.4 and IRIX 6.5. If it is necessary to read accounting data from one version of IRIX using tools from a different release of IRIX, acctcvt can be used to convert the data from the format used by the one release of IRIX to the other. For example, if the file "auditdata" contains IRIX 6.5 data, it can be converted to IRIX 6.2 format and written to the file "acctdata" with the following command: acctcvt --input_format extacct6.5 --input_source auditdata --output_format extacct6.2 --output_destination acctdata This can also be done more tersely by taking advantage of the default option settings and shorthand option names: acctcvt -o62 < auditdata > acctdata The file "acctdata" can now be used with other tools that may be expecting the IRIX 6.2 extended accounting format. Converting Accounting Data With Audit Filters Some accounting software may read extended accounting records directly from the System Audit Trail (SAT) using "audit filters" (see audit_filters(5) for more details on this technique). Software that does this and that was designed for an earlier release of IRIX may in many cases still be able to run on more recent releases of IRIX by using acctcvt as an audit filter. For example, suppose a program that was used to process IRIX 6.2 extended accounting records was invoked by placing its command line in the file /etc/config/satd.filter-1. In IRIX 6.5 this same software could be used in the same way by adding acctcvt as an additional filter that occurs before the accounting software. To do so, the file /etc/config/satd.filter-0 could be created, containing: acctcvt --output_format extacct6.2 If the accounting software did not expect to see a SAT file header, the --output_noheader option should be used as well: acctcvt --output_format extacct6.2 --output_noheader Using acctcvt With Other Audit Filters If the system audit facility is being used for conventional audit purposes in addition to collecting accounting data, it may be necessary to pass unmodified audit data on to other filters via stdout as well as writing reformatted data to a separate output file or accounting program. acctcvt provides the -o and -f options (or their long forms, --filter and --output_destination) for handling this situation. The -o option instructs acctcvt to copy all input data (except a file header, if present) to stdout, where it can be read by a subsequent audit filter. The -f option instructs acctcvt to write the converted accounting data to a specified file or command. Thus, a sample satd.filter-* file that causes IRIX 6.2 accounting records to be written to the file /var/adm/acctdata while passing unmodified audit records along to stdout would look like this: acctcvt -o -f /var/adm/acctdata -o62 If it is necessary to pass the reformatted data along to another program rather than a file, acctcvt can create a "tee" in the audit filter pipeline by starting a second command to which it passes the converted data while still copying the unmodified audit data to stdout. To do this, use the -f option as before, but specify the command preceded by the character "|" instead of a filename. For example, if the satd.filter-* file contained this: acctcvt -o -f '|/usr/bin/myacct -i -dir /acct' -o62 then the command "/usr/bin/myacct -i -dir /acct" would be started in a second process and it would receive IRIX 6.2-style extended accounting records from acctcvt via stdin. In the meantime, acctcvt would still continue to copy unmodified IRIX 6.5 audit records to stdout for use by other filters. Notice that the command is enclosed in single quotes to protect it from interpretation by the shell. In more complicated cases it may be helpful to write a simple wrapper script for the second command to avoid confusion. Handling SVR4 Accounting Data In addition to converting between different audit formats, acctcvt can also convert accounting data to or from the older SVR4 "pacct" format. The following command could be used to convert IRIX 6.5 extended accounting records into SVR4 format, which could then be passed along to SVR4 accounting tools like acctcom(1): acctcvt -osvr4 -f /var/adm/pacct < /var/adm/sat_9707201833 Conversely, SVR4 accounting data could be converted into SAT format for use with tools which expect extended accounting format data (although much of the extended accounting information will be missing): acctcvt -isvr4 -o65 -f /usr/tmp/satacct < /var/adm/pacct NOTES The SVR4 accounting format contains considerably less data than SGI extended accounting formats. When converting extended accounting data to SVR4 format, metrics not supported by SVR4 will be discarded silently. When converting SVR4 data to an extended accounting format, metrics not supported by SVR4 will be reported as 0. In addition, SVR4 does not split I/O metrics into separate counts for units read or units written. When converting SVR4 data to extended accounting format, these combined I/O counts will be reported simply as "read" data and the write counts will be 0. SEE ALSO acct(1M), acctcom(1M), satd(1M), sat_interpret(1M), acct(4), audit_filters(5), extacct(5).