[Info-vax] audit and accounting data into tabular or cross-platform format

[Hein RMS van den Heuvel]

On Aug 18, 6:05 am, IanMiller <g... at uk2.net> wrote:
> I expect Hein vdH has done this is in perl already :-)

For accounting, and batch job logs,  I have a few yes :-)
Never needed to do much with auditing.

I'll put two chunks below.

First one to scan a pre-generated listing to look for batch jobs
lasting more than 5 second, reporting by job name.

Second one executes the account command and processes the piped data,
looking for jobs using significant CPU.

Both reports  $user, $start, $finish, $elapsed, $cpu, $io in columns,
switch to CSV is trivial.

Hein


#----------------------------- ACCOUNTING_SUMMARY.PL
---------------------------
use strict;
use warnings;
use Time::Local;

my $MONTHS = "JANFEBMARAPRMAYJUNJULAUGSEPOCTNOVDEC";
my $ONE_DAY = 86400;


my (%jobs, $i);
$i = 0;

my  $batch = 0;
my  $batch_jobs = 0;
my  $lines = 0;
my ($date, $finish_time, $user, $elap, $cpu, $io, $job);

for (<>) {
    if (/^BATCH/) {
       $batch = 1;
       $date= $finish_time= $user= $elap= $cpu= $io= $job= "";
    }
    next unless $batch;
    chomp;
    if (/^Own.*\s(\d+:\d+:\d+).\d+/) {
       $elap = $1;
       $batch = 0 if $elap le '00:00:05';
       next;
    }
    $user = $1 if /^Username:\s+(\w+)/;
    $cpu  = $1 if /^Ter.*\s(\d+:\d+:\d+).\d+/;
    $job  = $1 if /^Job name:\s+(\w+)/;
    if (/^Acc.*ime:\s+(\d+)-(...)-(\d+)\s+(\d+):(\d+):(\d+)/) { #
Date ?
       $date = "$1-$2-$3 $4:$5";  # Re-assemble VMS Date
       $finish_time = timelocal($6,$5,$4,$1,index($MONTHS,$2)/
3,$3-1900);
    }
    if (/^Pag.*Direct IO:\s+(\d+)/){
       $io   = $1;
       $batch = 0;
       $batch_jobs++;
       if ($jobs{"$job $finish_time"}) {
         print STDERR "Dup for <$job> <$finish_time>\n";
       }
       $jobs{"$job $finish_time"} = "$date,$elap,$cpu,$io\n";
    }
# debug   last if $i++ > 2000;
}
print STDERR "Done reading, found $batch_jobs batch jobs longer than 5
second. Sorting array ", scalar %jobs, "\n";

for (sort keys %jobs) {
       print qq(Job Name,Finish Time,Elapsed,Cpu Time,Direct IO\n)
unless $lines++;
    my ($job,$time) = split;
    print $job, ',', $jobs{$_};
#    last if $i++ > 2040;
}

print STDERR "$lines printed\n";



# ---------------------------------------------  ACCOUNTING_BATCH.PL
-----------------------
use strict;
use warnings;

my $MIN_CPU = q(00:00:30);
my $MAX_CPU = q(00:20:00);

my $start_time = shift or die "need at least a start time, end  time
optional";
my $end_time   = shift;
my $command = shift  and die "Too many arguments. Forgot to quote date
+time?";
my $lines = 0;
$command = "account/full/proc=batch/type=process/since=$start_time";
$command .= "/before=$end_time" if $end_time;
my ($user, $start, $finish, $elapsed, $cpu, $job, $date, $io);
$date = '?';
for (qx($command)) {
   $user       = $1 if /^Use\S+\s+(\w+)/;
   next unless $user;
   if (/^Acc.*\s(\d+-\w+-\d+)\s+(\d\d:\d\d):\d\d\./) {
          $finish     = $2;
          if ($1 ne $date) {
             $date = $1;
             print "-- $date --   Jobs with more than $MIN_CPU cpu
time. STAR when more than $MAX_CPU\n";
             printf qq(-- %-9s %5s %5s %5s %8s %3s %1s %s\n),  qw(User
Start End Elap CPU Mio ? Job_name);
          }
   }
   $start      = $1 if /^Pro.*\s(\d\d:\d\d):\d\d\./;
   $elapsed    = $1 if /^Own.*\s(\d\d:\d\d):\d\d\./;
   $cpu        = $1 if /^Ter.*\s(\d\d:\d\d:\d\d)\./;
   next unless $cpu and $cpu ge $MIN_CPU;
   $job        = $1 if /^Job name:\s+(\S+)$/;
   if (/^Pag.*IO:\s+(\d+)/) {
      $io = $1/1000000;
      printf qq(%-12s %s %s %s %s %3d %s %s\n),
         $user, $start, $finish, $elapsed, $cpu, $io, ($cpu ge
$MAX_CPU) ? '*' : ' ', $job;
      $user = $cpu = $start =  $finish = $elapsed = $cpu = $job = '';
      $io = 0;
   }
}