sa

Display executable invocations per user (username not displayed)

$ sudo sa

$ sudo sa --print-users

$ sudo sa --user-summary

sa [options] [file...]

-a
    Show all commands, including those with zero usage.

-b
    Sort by sum of user and system time.

-c
    Sort by number of calls.

-d
    Disk I/O operations. (Not always accurate or enabled by default).

-D
    Sort by average disk I/O operations.

-f
    Force reading accounting files even if corrupted or truncated.

-i
    Ignore usernames; sum by command name only.

-I
    Interactive mode. Prompt for confirmation before reading large files.

-j
    Print command names with arguments.

-k
    Sort by kilobytes transferred (disk I/O).

-K
    Sort by average kilobytes transferred per call.

-l
    Sort by real time (elapsed time).

-m
    Sort by average memory usage.

-n
    Show only the top commands.

-p
    Print per-user statistics.

-r
    Reverse the sort order.

-s
    Merge all accounting files before processing.

-S
    Sort by system CPU time.

-t
    Sort by sum of user, system and real time.

-u
    Sort by user CPU time.

-v
    Verbose mode. Print more detailed information.

-y
    Summarize by UID, not command name.

-z
    Show percentage of total.

The sa command analyzes data from process accounting files (typically `/var/log/account/pacct` or `/var/account/pacct`), providing summaries of command usage. It can generate various reports, including CPU time used per command, number of invocations, real-time elapsed, and average memory usage. It reads process accounting records, which are created by the operating system for each terminated process and aggregates the data to produce readable statistics. The command offers flexible options to sort the output, filter specific users or commands, and tailor the report to focus on particular aspects of system resource usage.
sa is invaluable for system administrators aiming to understand how system resources are being utilized, identify resource-intensive processes, and optimize system performance. The accuracy and completeness of the reports depend heavily on proper process accounting configuration and the integrity of the accounting data files. Using this data properly can greatly improve security and efficiency.

The accuracy of the reports generated by sa depends heavily on the proper configuration of process accounting and the integrity of the accounting data files. Process accounting may not be enabled by default in all systems. The disk I/O data can be unreliable or inaccurate depending on kernel versions and system configuration.

The accounting files read by sa are binary and are not designed to be human-readable directly. They contain information about each process executed on the system. The exact format can vary depending on the operating system and configuration.

Ensure that the process accounting files are properly secured, as they may contain sensitive information about command execution and user activity.

The sa command has been a part of Unix systems for a considerable time. Its purpose remains consistent: to provide insights into system resource usage by analyzing process accounting data. Over time, enhancements have been made to include more sorting options and reporting capabilities to accommodate evolving system administration needs.

accton(8), lastcomm(1), dump-acct(8)