Open Source

I spy my users' uptime: Linux system accounting with ac and uptime

Just how long has that employee been working on the database machine? Need to know? Well, if you're using Linux, it's not a problem. With the help of two simple commands, Jack Wallen, Jr. shows you that system accounting in Linux is a snap.

Let’s go on a little adventure into the land of the obscure and take care of some Linux system accounting with two simple, yet helpful, commands: ac and uptime.

I’ll begin this Daily Feature by saying that these two commands are not going to help you optimize your network, save crashed servers, keep you under budget, or make your breakfast. What they will do, however, is give you some granular insight into the state of your system, as well as certain habits of your users.

Getting to know your users with ac
We're not talking about air conditioning or even ab crunches; we're talking about user connection accounting. This handy little command, which must be run through the command-line terminal, reads the/var/log/wtmp file and prints out the connection time (in hours) to standard output (i.e., the console window). This connection time is based on user logins and logouts.

The command's syntax is pretty standard fare:
 ac [-dhpVy] [-f <file>] [people]

And the command has a number of flags:
[--daily-totals] [--individual-totals]
[--file <file>] [--complain] [--reboots]
[--supplants] [--timewarps] [--print-year]
[--compatibility] [--print-zeros] [--debug]
[--tw-leniency <value>] [--tw-suspicious <value>]
[--version] [--help]

Let's take a look at the most basic usage of the command:

This will report the total hours the machine has been logged into (not the same as uptime, mind you). So if we run the ac command without options or arguments, we will get something like this:
(jlwallen): ac
        total       32.78

If you notice an odd prompt in the above example, don’t be afraid. Where you would normally see something like [user@host host]$, I have configured it to show (user):. If you would like to learn how to customize your bash prompt, check out ”You're not just a number: Customizing your bash prompt,” by yours truly.

The above command reveals that this particular machine has been logged into for 32.78 hours. You might think that if we switch to, say, root and run the command, we would come up with a different total. Let's take a look:
[root@willow jlwallen]# ac
       total       33.15

It's not the same. Why? Well, between the time I had run the command as jlwallen and as root, time had passed. How much time? It's obvious that we're not looking at the standard HH:MM time format, otherwise, we'd have more than 60 minutes in an hour and that would pretty much throw the world into total chaos, just because UNIX and Linux wanted more time!

But you need to think of time in decimal fractions of an hour. If we take the above output, 33.15, we’d look at it as 33 hours and 15/100 of an hour and we'd represent this with the equation:
15/100 = x/60
100x = 900
or even better:
x = 9

So 33.15 hours would wind up being 33 hours and 9 minutes. Simple, eh? This timekeeping system is great for billing purposes. What better means of accounting than using decimal instead of standard time?

Let's make this command a little more useful. Let's say we want to see how many hours a particular user has been logged in to a machine throughout the workweek. We can use the -d switch to add the dates to the output (as well as see a week’s worth of output). So with the command ac –d, we'd see something like:
(jlwallen): ac –d
Jul  1  total        0.01
Jul  2  total        4.23
Jul  3  total        6.78
Jul  4  total        0.09
Jul  5  total       7.67
Jul  6  total       10.02
Today   total       23.68

Of course, if you have more than one user on your system, the above output really doesn't help much. You'd wind up having to su into each user account and run the command. However, we can add the -p switch to associate a name with the login time. With the command ac –dp, we'd see:
(jlwallen): ac -dp      
        jlwallen                             0.01
Jul  1  total        0.01
        jlwallen                             4.23
Jul  2  total       4.23
        jlwallen                             6.78
Jul  3  total        6.78
        jlwallen                             0.09
Jul  4  total        0.09
        jlwallen                             7.67
Jul  5  total        7.67
        jlwallen                           10.02
Jul  6  total       10.02
        gopher                               0.01
        jlwallen                            23.86
Today   total       23.86

Now you see the user name, the date, and the login time associated with each day’s login. You'll see here that on July 6th, the user "gopher" logged in. Hmm, should gopher have been logged in all week?

Getting uptime
Another little application that works perfectly alongside ac is uptime. The uptime application is a rather single-minded application in that it reports how long the system has been up and running. The syntax of the command is very simple:

That's all there is to it. When you run the command, the output will look very similar to this. It shouldn't be difficult to decipher what the output means. The first chunk of output, 10:23pm, is the current time. The second bit informs you how many days the system has been up. (I know, seven days is shameful and I should probably be flogged, but we had a bad thunderstorm the other day, I swear!) The third bit tells you how many hours (past the number of days) the system has been up. In our example, our machine has been up seven days, 15 hours, and 37 minutes. The next section tells you how many users are logged in to the system; this can be a bit deceiving since you have some “fake” users, like apache and lpd, which are necessary. The last section reports the load average for the last one, five, and 15 minutes.

Putting them together
Putting the two commands together is very simple. Run the commands like so:
ac -dp ; uptime

Your output will look something like this.

Voila—instant user accounting!

How you use these commands is pretty much up to your imagination. Put them in a cron job and send the output to a printer every morning or create a dynamic Web server and have the output sent to an automatically updated Web page, just to humor your employees. I'm sure the ideas are rumbling through your evil mind as you read.

If you need more help on either of these applications, take a look at the man page with these commands:
man ac
man uptime


Jack Wallen is an award-winning writer for TechRepublic and He’s an avid promoter of open source and the voice of The Android Expert. For more news about Jack Wallen, visit his website


Editor's Picks