sa

Display executable invocations per user (username not displayed)

$ sudo sa

$ sudo sa --print-users

$ sudo sa --user-summary

sa [options] [files]

-a
    Print all command names, even those that haven't been executed.

-b
    Print average statistics (CPU time, I/O) for commands, along with other data.

-D
    Sort output by total disk I/O operations (blocks transferred).

-k
    Print CPU usage in kcore-minutes, a measure of memory * time.

-l
    Separate statistics for commands executed by `fork`ed processes (e.g., shell commands).

-m
    Print statistics for each user, including the total for all commands executed by that user.

-n
    Sort output by the number of calls (executions) of each command.

-r
    Reverse the sorting order of the output.

-s
    Print a system-wide summary of accounting data, rather than individual command statistics.

-t
    Print the total number of characters transferred by processes.

-u
    Equivalent to -m; prints statistics for each user.

-v
    Verbose output; prints system usage (CPU time, I/O) by command.

[files]
    Specify one or more alternative accounting files to read instead of the default.

The sa command reads and summarizes information from the system's process accounting file, typically /var/log/account/pacct or /var/account/pacct. This file contains records of processes that have completed, including their CPU usage, I/O operations, memory consumption, and execution duration.

sa is a crucial tool for system administrators to monitor resource consumption, identify heavily used commands or users, and analyze historical system activity. It can present data aggregated by command, per user, or provide a system-wide summary. The data collected by the kernel (when process accounting is enabled via accton) allows sa to provide insights into system workload patterns and aid in performance tuning and auditing.

Process accounting must be actively enabled on the system (typically via the accton command) for sa to collect and display data. If accounting is not enabled or the accounting file is empty, sa will report no data. The accounting file can grow very large and requires proper log rotation to prevent disk space exhaustion.

sa primarily reads its data from the system's process accounting file, which by default is often /var/log/account/pacct or /var/account/pacct. This binary file is populated by the kernel when process accounting is enabled.

To collect data for sa, process accounting must be enabled. This is typically done by running sudo accton /var/log/account/pacct (or your chosen accounting file path). Without accounting enabled, sa will report no data.

The sa command, along with the underlying process accounting system, has been a fundamental component of Unix-like operating systems since their early versions. Its core purpose of tracking and summarizing process resource usage for billing and system management has remained consistent over decades. While specific implementations and default file paths may vary slightly across different Linux distributions, sa is universally recognized as a standard utility for system monitoring and auditing, typically found within the psacct or acct packages.

accton(8), lastcomm(1), dump-acct(8), acct(5)