man uaklogin
NAME
uaklogin - Reports login terminal and process information
SYNOPSIS
uaklogin [-options]
DESCRIPTION
The uaklogin command reports the following information:
+ Terminal information as obtained from the utmp or wtmp file;
+ Terminal access (read) and modify (write) times obtained from the ter-
minal device special file, such as /dev/tty*;
+ Optionally, process tree information from a 'ps' variant.
uaklogin began as a utility to dump the contents of the utmp or wtmp file
which grew to include options to select or filter specific information.
When reading the utmp file, terminal access (keyboard input) and modify
(terminal output) times are also displayed and options and filters also
exist for displaying process tree information. uaklogin provides in a sin-
gle command the ability to display terminal and process information often
gathered through a combination of finger and multiple ps commands. Because
of the volume of information displayed, a 132 column screen is required.
ACTIONS and OPTIONS
Actions (only one of the following may be specified)
-utmp Utilize the utmp file. This is the default.
Note, for IRIX (sgi) the extended utmpx file format is used.
Process tree display and command filters are applicable only with
the utmp file.
-wtmp Utilize the wtmp file.
-both Utilize both the utmp and wtmp files.
-files filename[s]
To specify an input filename which must be in ?tmp format.
Multiple files can be white space (in quotes) or comma separated.
!x For IRIX (sgi), use utmp|wtmp file and utmp record format.
The IRIX (sgi) default is extended utmpx format and files.
General Options
-ps To include a process tree of matching records.
Can only be used with -utmp.
Implies -User if no record type filter was specified. The -ps option
is implied with -comm, +comm, -Parents, -pid or =pid.
-Parents
To includes parent and ancestor processes. Implies -ps.
-terminal
To generate stdout lines in format "pid # user # tname # idle time"
which can be piped into an xargs kill or into ua_killer.ksh. Written
to stdout, use -output to isolate off the logging output.
+terminal
To skip utmp record display, this option is really only pertinent with
-pid or =pid options, you might as well use a 'ps -p list'.
-output
To specify an output file (other than stdout).
-binary
To specify a binary output file for selected records.
-verbose
To include display of command options and some debugging information.
-? Display terse help message.
Filter Options
If multiple filter options are specified the results are a logically and'd.
-pid pid1[,pid2...]
To display tree of a specific pid. Implies -Parents.
Cannot be used with -line because will set line to that of pid.
The -pid option implies -Parents.
If pid does not correspond to a terminal the proces tree is
displayed regardless of any other filter criteria.
=pid pid1[,pid2...]
To display particular pid(s) without complete tree(s).
-idle minutes
To select only utmp entries where the corresponding /dev/tty*
access time (keyboard input) is greater than the specified number
of minutes.
-name user1[,user2...]
To select one or more users to report on.
-userid user1[,user2...]
To select one or more users to report on, alias of -name.
+name user1[,user2...]
To exclude specific users.
+userid user1[,user2...]
To exclude specific users, alias of +name.
-line tty1[,tty2...]
To select one or more terminal names to report on.
The * and ? wildcards can be used.
+line tty1[,tty2...]
To exclude specific terminal names.
-comm command1[,command2...]
To select one or more commands to report on.
The * and ? wildcards can be used.
Implies the -ps option and will report the process tree if the com-
mand is found anywhere in the tree. The command string includes any
options (up to 64 bytes) so an implied wildcard is added to the
specified command(s). A leading * may be required if the command
was invoked with full path. Leading wildcards require the command
string be enclosed in quotes.
+comm command1[,command2...]
To exclude specific commands.
Record Type Options
With -ps or any option which implies -ps, the default is -User if nothing
is specified. Otherwise, the default is -All. Any specifications of
record type are logically or'd.
-User To select only user records.
-Dead To select only 'dead' records.
-Login To select only login records.
-Other To select only 'other' records (e.g., boot, run-level, etc.).
-All To select all record types.
DISPLAY FORMAT (headers)
Two forms of headers are used, utmp|wtmp and ps format. When the -ps option
is requested, the utmp and ps information is interleaved so the processes
can be associated with the utmp login record.
The -utmp|-wtmp header has the following form:
09/04@102844
_Entry Time_:_pid__:__user__:__Access___:__Modify___:_id_____:__line__:__type__:_trm_ext:____login host____
Where:
_Entry Time_ is record entry time (login)
_pid__ is UNIX pid
__user__ is userid
__Access___ is /dev/tty* access elapsed time (keyboard input)
__Modify___ is /dev/tty* modify elapsed time (terminal output)
_id_____ is terminal id
__line__ is terminal device name
__type__ is record type
_trm_ext is termination and exit status
_login host_ is login source
The date in the header is the execution date of the program since uaklogin
display output tends to get copied in problem tracking information.
The -ps header has the following form:
_pid__ _ppid_ __user__ Started VSZ RSS CPU_Time %CPU |__Command__
Where:
_pid__ is process pid
_ppid_ is process parent pid
__user__ is userid
Started is ps format process start time
VSZ is ps format virtual size
RSS is ps format real size
CPU_Time is ps format cpu time
%CPU is ps format percent cpu (snapshot)
__Command__ is ps format command string (64 byte maximum)
In addition, an indicator of the form:
Non-terminal processes:
will delineate terminal from non-terminal processes.
Prior to the pid display is a digit indicating the level of the process in
the tree from init. In the case of non-terminal processes the level is
displayed as negative numbers.
EXAMPLES
Standard utmp format:
sxkac@nugget: uaklogin -n sxkac
09/13@141338
_Entry Time_:_pid__:__user__:__Access___:__Modify___:_id_____:__line__:__type__:_trm_ext:____login host____
09/13@102020: 2029:sxkac : 00.00.00: 00.00.00:ttyp0 :ttyp0 :User : 0, 0:137.229.13.98
09/13@141059: 22171:sxkac : 00.00.41: 00.00.41:ttyp3 :ttyp3 :User : 0, 0:java.sois.alaska.edu
With the -ps option:
sxkac@nugget: uaklogin -n sxkac -ps
09/13@141348
_Entry Time_:_pid__:__user__:__Access___:__Modify___:_id_____:__line__:__type__:_trm_ext:____login host____
_pid__ _ppid_ __user__ Started VSZ RSS CPU_Time %CPU |__Command__
09/13@102020: 2029:sxkac : 00.00.00: 00.00.00:ttyp0 :ttyp0 :User : 0, 0:137.229.13.98
3 2029 16321 sxkac 10:20:11 1.57M 312K 0:02.68 0.0 |-ksh (ksh)
4 14382 2029 sxkac 14:13:48 1.31M 144K 0:00.03 1.0 |uaklogin -n sxkac -ps
5 19697 14382 sxkac 14:13:48 1.71M 160K 0:00.03 1.0 |sh -c ps -A -o tname,user,pid,ppid,start,vsz,
6 23467 19697 root 14:13:48 1.83M 648K 0:00.46 6.0 |ps -A -o tname,user,pid,ppid,start,vsz,rss,cp
09/13@141059: 22171:sxkac : 00.00.52: 00.00.52:ttyp3 :ttyp3 :User : 0, 0:java.sois.alaska.edu
3 22171 12347 sxkac 14:10:59 1.58M 296K 0:00.77 0.0 |-ksh (ksh)
4 11363 22171 sxkac 14:11:05 1.28M 192K 0:00.07 0.0 |man uaklogin
5 23718 11363 sxkac 14:11:06 1.71M 160K 0:00.02 0.0 |sh -c more -svf cat8/uaklogin.8
6 18453 23718 sxkac 14:11:06 1.70M 344K 0:00.08 0.0 |more -svf cat8/uaklogin.8
Sessions idle for 7 days (10,080 minutes):
sxkac@java: uaklogin -idle 10080
09/04@123853
_Entry Time_:_pid__:__user__:__Access___:__Modify___:_id_____:__line__:__type__:_trm_ext:____login host____
08/27@105145: 6439:sxidh :7d 19.23.58:2d 23.50.05:ttyp1 :ttyp1 :User : 0, 0:sxidh-1.sois.alaska.edu
Note the modify time is 2 days and the access time is 7 days, this reflects
that a 'wall' broadcast occured to all users 2 days prior.
Selecting two users and a specific command:
sxkac@nugget: uaklogin -n sxfint,sxtrnx -ps -command "*gurjobs"
09/04@110837
_pid__ _ppid_ __user__ Started VSZ RSS CPU_Time %CPU |__Command__
Non-terminal processes:
-1 1347 1 sxfint Aug 31 4.28M 0K 0:00.27 0.0 |gurjobs -o /log/gjajobs/gurjobs_FINT.log.lis
-2 1350 1347 oracle Aug 31 41.1M 4.4M 0:04.57 0.0 |oracleFINT (DESCRIPTION=(LOCAL=YES)(ADDRESS=
-1 1354 1 sxfint Aug 31 4.28M 0K 0:00.23 0.0 |gurjobs -o /log/gjajobs/gurjobs_FINT.log.lis
-2 1356 1354 oracle Aug 31 41.0M 3.8M 0:03.07 0.0 |oracleFINT (DESCRIPTION=(LOCAL=YES)(ADDRESS=
-1 1475 1 sxtrnx Aug 31 4.28M 0K 0:00.19 0.0 |gurjobs -o /log/gjajobs/gurjobs_TRNX.log.lis
-2 1477 1475 oracle Aug 31 69.2M 4.1M 0:04.90 0.0 |oracleTRNX (DESCRIPTION=(LOCAL=YES)(ADDRESS=
-1 1479 1 sxtrnx Aug 31 4.28M 0K 0:00.16 0.0 |gurjobs -o /log/gjajobs/gurjobs_TRNX.log.lis
-2 1481 1479 oracle Aug 31 69.1M 3.7M 0:02.27 0.0 |oracleTRNX (DESCRIPTION=(LOCAL=YES)(ADDRESS=
Note these processes are not associated with a terminal.
Tracking a specific user:
sxkac@glacier: uaklogin -n fnpg -ps
09/04@123828
_Entry Time_:_pid__:__user__:__Access___:__Modify___:_id_____:__line__:__type__:_trm_ext:____login host____
_pid__ _ppid_ __user__ Started VSZ RSS CPU_Time %CPU |__Command__
09/04@073510: 20307:fnpg : 00.09.46: 00.09.46:ttyz6 :ttyz6 :User : 0, 0:fnpg.admin.uaf.edu
3 20307 11622 fnpg 07:35:03 1.55M 40K 0:00.25 0.0 |-ksh (ksh)
4 31098 20307 fnpg 07:35:11 1.37M 48K 0:00.09 0.0 |/usr/local/bin/menu
5 11028 31098 fnpg 07:35:27 21.6M 5.9M 0:10.53 0.0 |runform45 GUAINIT TERM=ua1:vt220
6 19353 11028 oracle 07:35:32 1.45G 92M 0:14.11 0.0 |oracleFINP (DESCRIPTION=(LOCAL=YES)(ADDRESS=
Non-terminal processes:
-2 32306 625 fnpg 07:45:17 1.63M 40K 0:00.10 0.0 |ksh /log/gjajobs/R/G0.19970904.074515:FINP:f
-3 12743 32306 fnpg 07:45:18 5.60M 408K 0:01.76 0.0 |tsrcbil -f -o /log/gjajobs/users/fnpg/tsrcbi
-4 18108 12743 oracle 07:45:18 1.45G 154M 0:28.65 0.0 |oracleFINP (DESCRIPTION=(LOCAL=YES)(ADDRESS=
The user is executing an Oracle form (runform45) interactively and has a
batch application 'tsrcbil'. Both have Oracle dedicated servers as chil-
dren.
Requesting by pid:
kcarlson@yukon: uaklogin -p 20759
09/13@144952
_Entry Time_:_pid__:__user__:__Access___:__Modify___:_id_:__line______:__type__:_trm_ext:____login host____
_pid__ _ppid_ __user__ Started VSZ SIZE CPU_Time %CPU |__Command__
09/13@142520: 20759:kcarlson: 00.00.02: 00.00.00:p001:ttyp001 :User : 0, 0:137.229.13.98
0 1 0 root 01:19 936 234 364.05 - |init S
1 413 1 root 01:22 1500 375 15.09 - |/etc/inetd /etc/inetd.conf
2 20758 413 root 14:25 1608 402 4.07 - |telnetd
3 20759 20758 kcarlson 14:25 1816 454 3.04 - |-ksh
4 21015 20759 kcarlson 14:49 848 212 0.00 - |uaklogin -p 20759
5 21016 21015 kcarlson 14:49 992 248 0.08 - |ps -A -o tty,user,pid,ppid,stime,vsz,sz,cputime,pcpu,args
RESTRICTIONS / NOTES
uaklogin has been tested under DU v3.2g and v4.0b, IRIX 6.2 through 6.5,
Unicos 9.0 and 10.0, and Unicos/mk 2.0. Use the uaklogin v3.0 (v2.8 kit)
or higher for Irix 6.5 as ps format changed, uaklogin v3.0+ should work for
Irix 6.2 through 6.5.
Suggestions for enhancements or bug reports can be directed to
dutools@ts.sois.alaska.edu.
uaklogin exits:
0 if any records displayed
1 if no matching records
2+ if any error in command syntax
uaklogin utilizes the cci command parser utilized by non-UNIX operating
systems instead of the traditional UNIX getopt() parsing. Actions and
options have been defined to "look like" UNIX style options, but can be
spelled out or abbreviated. For example '-n' is the same as '-name'.
Because of this multiple options must be space separated and the hyphen is
part of the option name.
The -ps option to generate process tree information utilizes an internally
piped ps command in the format of:
ps -A -o user,pid,ppid,start,vsz,rss,cputime,pcpu,command
for Digital UNIX (for other flavors a different syntax may be utilized)
which is then internally parsed. If you have a system with thousands of
processes, this can make execution slow like a "ps -ef" command, have pati-
ence.
One of the primary utilities of the -ps option is to get the associated
process tree and resources used at each level. For example if you utilize
Oracle dedicated servers, the server process is a child of the user but
owned by oracle, "uaklogin -n sxkac -ps" associates the server with the
parent user and accomplishes the same thing as:
ps -u snkac,oracle -o ... | grep -E 'snkac|oracle_pid'
On IRIX 6.2 'ps -A' returns tty name in the form of pts/* instead of tty*
returned by a 'ps' (without -A) and as retained in the utmp file. Because
of that, uaklogin on __sgi systems matches -pid requests against the userid
instead of tty name and does a secondary match against the pid. The IRIX
6.2 utmpxname()|getutxent() functions are broken, getutxsgi() is provided
as a replacement... see the comments in the routine.
ACKNOWLEDGEMENTS
The uaklogin utility was written at the University of Alaska.
Concepts for constructing the process tree information were obtained from
pstree v1.4 provided by Fred Hucht (hal6000.Uni-Duisburg.DE).
The re-written pstree code is available as a function for other applica-
tions, look at ua_get_ps() within the distribution.
RELATED INFORMATION
Files: utmp(4), wtmp(4).
utmpx(4), wtmpx(4) on IRIX (sgi).
Commands: ps(1), finger(1), uakpacct(8), last(8).