SAC(8)

✨ NAME ✨

sac — system accounting. yes bestie, this is the SAC(8) page from the System Manager's Manual, and it's giving system admin realness. 💅

---

🎀 SYNOPSIS 🎀

sac [-acdfFhilmoprtU] [-w [wtmp-list|-]] [-b H[:M[:S]]] [-s start] [-e
       end] [-X[3|4]] [[-u] user-list] [-x [user-list]] [-T [tty-list]] [-H
       [host-list]] [-I H[:M[:S]]] [-M hour-range[,...]]  [-R
       [portmaster/pattern-list]] [--seconds] [--hms] [--hm] [--hours]
       [--round] [--longdate] [--help] [--version]

---

🌸 DESCRIPTION 🌸

💖 what even is sac

Sac is a system administration utility. It's based on the original BSD ac program, and its whole thing is reading the wtmp log and producing system usage info that's way more human-readable than what last gives you. Several features that are not in the BSD version of this program have been added. 👑

🍓 the output types

Okay so sac produces five different types of output (the manpage says five, then lists six — we're just the messenger 💀):

• total usage in number of login hours since wtmp was created — this is the default
• login usage per day (-d)
• total usage per user (-p)
• usage per tty line (-t)
• simultaneous usage (-U)
• raw usage (-r), which prints everything sac knows about your accounting file(s)

The output of these six gets modified by supplying either the average (-a) option, the hourly profile (-h) option, the login listing (-l) option, and/or the clipping (-c) option.

📅 date selection: -s and -e

The -s and -e options are used to select the starting date and ending date, respectively, to report on. The format for the date is one of:

• +days — days since the beginning of the wtmp file
• -days — days before the end of the wtmp file
• standard date format: MM/DD/YY

⏰ hour range: -M

The -M option is used to select only specific hours in a day to perform accounting on instead of all the hours in the day. The hour-range format is: (0-23)[-(0-23)[,hour-range[,...]]]. The hour given applies to the whole hour, so a range of "5-6" is a time range from 5am to 6:59:59am. This option is probably only useful to those ISP providers that want to charge a different rate for specific time periods.

✨ average option (-a)

Selecting the average option for total usage gives an average number of login hours per day since the creation of the wtmp file. For the daily option it prints the total # of logins for the day and the average login time per login. For the per person display it displays the total number of logins the user has made and the average amount of time spent on each login. For the TTY option, it prints the total number of logins on that TTY and the average amount of time for each login.

🦋 hourly profile option (-h)

Selecting the hourly profile option for total usage gives a visual display of the percentage of login time spent per hour for all the logins on the system. For the daily option it prints the same visual display for each day. For the per person display it displays the hourly breakdown of login time the user spends on the system (this can be pretty interesting). For the TTY option it breaks down hourly usage for each TTY.

📝 login listing option (-l)

Selecting the login listing option shows the logins and total time for each individual login for the time period requested on each day, tty line or person depending on the profile requested. Such output is ready-made for use as an ISP billing back-end.

✂️ clipping option (-c)

Selecting the -c option performs clipping on the amount of login time being used. Multiple logins during the same time period will only count once. As a side effect (possibly a bug) clipping will affect the output of the average option, reporting only the number of logins that uniquely apply to the total login time. Logins that fall totally within the time span of other logins will be totally clipped out, as if they did not occur.

⚠️ bestie, that "possibly a bug" is straight from the manpage — don't @ me.

👥 user lists, -u, and -x

If the optional user-list is given, sac will only consider accounting information from those users, discarding the rest. The -u option can be used to precede the optional user-list. This option is useful to terminate the -x, -T and -H options.

The -x option has the reverse effect of the -u option, in that it excludes the users specified from accounting. This is useful for removing users that are on a lot, which skew average usage results.

🖥️ tty lines: -T

The -T option performs accounting for only the optionally specified tty lines listed. This is useful for determining modem usage, and who's been using them the most. The tty line may be given as a wildcard pattern, using *, ?, [...] and [^...] to easily select a given set of tty lines (such as ttyC* to produce accounting on cyclades tty lines). Wildcard patterns should be escaped or quoted to avoid having the shell process them.

🌐 hosts: -H

The -H option performs accounting for only the optionally specified hosts listed. Since a host-name can only be up to 16 characters long in the wtmp file, only the first 16 characters of a given host-name will be considered for purposes of matches. If a host-name given on the command line does not contain any dots (.) or ends with a dot, it is taken to be a substring and will match if the first part of the wtmp host-name matches the substring. Like with tty lines, the hostname may be given as a wildcard, using *, ?, [...] and [^...] to easily select a large number of hosts at once (such as *.indstate.*).

📂 include files with @

If an option word used in a -u, -x, -T or -H list begins with an @ (at) sign, it denotes that the option word specifies a file which contains a list of usernames, ttys or hostnames to be applied to the specific option. The "include file" may contain comments which are denoted by a # (pound) character at the beginning of a line, ala shell scripts. If a word in an include file begins with an @ as well, it denotes another file is to be included.

📡 ftp logins: -f and -F

The -f option makes sac perform accounting on both normal logins and ftp logins. The -F option makes sac perform accounting on ftp logins, normal logins are not considered. Sac is only guaranteed to work with wu-ftpd (wu-archive FTP daemon) style of utmp entry for ftp logins, denoted by a line of "ftp#####" where "#####" is the process ID of the ftp process.

⏳ time formats: --seconds, --hms, --hm, --hours, --round

The time format for sac defaults to fractions of hours. Thus 1.5 hours is 1 hour and 30 minutes. The output time format may be changed using the command line options --seconds (seconds only), --hms (hour:minute:second format), --hm (hour:minute format), --hours (hours only format), and --round which rounds the time to the nearest minute or hour instead of always rounding down.

✨ OPTIONS ✨

okay bestie, here's the whole menu of switches sac understands 💅 pick your faves:

• --help — dumps out a verbose usage listing. like, it tells you everything. go off.
• --verbose — prints alerts whenever sac bumps into errors or other weird strange phenomena 👀. and here's the tea: if there's a null wtmp entry (which, btw, is sometimes what crackers do to cover their tracks 🙈), sac prints an approximate time stamp along with the alert. forensic queen behavior.
• --version — outputs the version of sac. that's it, that's the whole thing.
• -w [wtmp-list|-] — picks a different input file (or files) instead of the default (/var/log/wtmp). heads up tho: the accounting file type is decided by whatever options you used before -w gets reached. order matters, bestie.
• -d — lists login time per day instead of the default total time.
• -p — lists login time per user instead of the default total time.
• -t — lists login time per tty line instead of the default total time.
• -U — lists simultaneous usage levels 🔥. it shows the amount of time at each usage level (usage level = number of ttys used simultaneously) plus the number of accountable hours (that's time * usage level) at each usage level.
• -r — prints almost everything sac knows about your wtmp file. time gets displayed in seconds. the Hourmask is a 24 bit field representing which hours accounting was performed on (zero means no mask used). the format is fairly obvious. useful as a back-end to some accounting package or for graphing usage. quite verbose, ngl.
• -a — prints average information.
• -h — prints hourly profile information.
• -l — prints login listing information.
• -c — performs login "clipping". multiple logins during the same time period only count once. lowkey a glow-up for your numbers ✨
• -I H[:M[:S]] — ignores a specific amount of login time for each user before doing accounting. ⚠️ only works with the -p option, no cap.
• --seconds — displays time in seconds.
• --hms — displays time in Hours:Minutes:Seconds format.
• --hm — displays time in Hours:Minutes format. seconds get rounded off.
• --hours — displays time in hours only format. minutes and seconds get rounded off.
• --round — rounds the displayed time to the nearest minute when you're using --hm, or to the nearest hour when you're using --hours.
• --longdate — displays dates in long notation (weekday, month, day and four digit year). very main character of the dates 💖
• -o — reads the wtmp file as if it were an old style BSD wtmp file (that's the old utmp format, which doesn't use the ut_type field). programs like tacacs keep a wtmp file that doesn't use all the fields, so yeah.
• -S — attempts to seek into wtmp to the day specified by the -s option (-s MM/DD/YY). not guaranteed to work 🫠. if the seek fails, it'll try to rewind input to the beginning and continue normally. useful for seeing last day's usage from a large wtmp file.
• -X[3] — reads a wtmp file maintained by xtacacs, that's terminal server access control software, versions 3.4 and 3.5.
• -X4 — reads a wtmp file maintained by xtacacs version 4.0.
• -i — includes hostname information when trying to determine logins and logouts. super useful for accurately parsing tacacs accounting logs that merge accounting for multiple terminal servers into the same log. detective mode 🔍
• -R portmaster/pattern-list — reads and processes the detail files maintained by the Radius access control software for terminal servers. sac will process each detail file in /usr/adm/radacct/<portmaster-name>/detail, each in turn, until all the detail files have been processed. if no portmaster name is given, a detail file must be specified with the -w option. if a wildcard pattern is given, sac will try to find all portmaster directories in the radacct directory that match the pattern. and yes, a detail file may be specified with -w in addition to -R.
• -D — when processing radius logs, this says sac should use the @hostname part of user@hostname for the hostname field instead of portmaster's hostname. handy for -H filtering when you're working with radius logs.
• -P — performs packet and octet accounting when reading from a detail file that logs packet and octet information (i.e. Ascend terminal servers).
• -b hours[:minutes[:seconds]] — considers only those utmp entries that fall within the last few hours/minutes/seconds from the current time, and disregards the rest. useful for figuring out if someone's been on in the last few hours 👀
• -s start — selects the starting date of the report.
• -e end — selects the ending date of the report.
• -M hour-range[,...]] — selects only specific hours in a day to perform accounting on, instead of all the hours in the day. the hour-range format is: (0-23)[-(0-23)[,hour-range[,...]]]. and the hour given applies to the whole hour, so a range of "5-6" is a time range from 5am to 6:59:59am. no sneaky half-hours, bestie.
• -f — performs ftp login accounting in addition to normal shell accounting.
• -F — performs ftp login accounting only.
• -m — shows minimum and maximum number of concurrent logins over the total time span, or per day/per user when used with the -d/-p option.
• -u user-list — selects only those users to perform accounting on.
• -x user-list — selects those users to not perform accounting on. begone 🚫
• -T tty-list — selects those ttys to perform accounting on. each tty specifier may be a wildcard.
• -H host-list — selects those hosts to perform accounting on. each host specifier may be a wildcard.

---

🌸 FILES 🌸

• /var/log/wtmp — login database
• /usr/adm/radacct/.../detail — Radius accounting logs

---

👑 AUTHOR 👑

Steve Baker (ice@mama.indstate.edu) — the icon, the legend 💖

---

💀 BUGS 💀

ngl bestie, this section is long and it's all real, so buckle up:

• The documentation for wtmp is lacking. it's not clear at all what all gets put in wtmp or the significance of any of it. the docs really said "figure it out" 😭
• The -o and -X options handle what is a login and what is a logout differently than normally (because there's no ut_type field), which makes sac incorrectly identify xterm log-outs as a login. (xterm doesn't write a "login" entry, only a "logout" entry that looks just like a login in all respects save the contents of the ut_type field.) it should also be noted that last incorrectly handles xterm log-outs as well. so it's not just us 🫶
• The -f or -F options should not be used with -o, -X[3|4] or -R options, because sac will default back to a normal utmp format, or ignore the -f or -F directives depending on where they occur on the command line. order-dependent chaos, fr fr.
• Using the -S option will cause sac to skip over accounting information which may well apply to the days you are inspecting 😬. the only sure way to get all the accounting information is to start at the beginning, or at least a day before the start you're interested in.
• The -m option does not accurately report true min/max usage when inspecting more than one logfile if those logfiles overlap the same time range.
• The -U option may report incorrect amounts of time when compared to the -t option. as yet, the author has no idea why. it's giving mystery ✨
• Sac (probably) only handles changes in time logged in the wtmp file made by netdate. Rdate does not log time changes.
• Clipping can affect the output of the average option, as described above. Radius accounting uses Acct-Session-Time to determine usage when a stop record has no start record. clipping will not function correctly when there are missing start records.
• The ut_addr field doesn't seem to be consistently used by all programs, so it can't be used for exact host-name filtering. even if it were, it would be too much work for this lazy programmer anyway 🙈 honestly? relatable.
• Radius detail logs suck. there is not one standard radius detail file format. sac is not guaranteed to work with your detail file. if you suspect sac's output is not correct, please contact the author at the e-mail address above.
• Null usernames in radius detail logs are represented as "UNKNOWN" by sac, which may be a valid username. yes, that's as confusing as it sounds.
• Too much accounting results in big brother... citizen. 💀

---

🦋 SEE ALSO 🦋

ac(1), last(1), rawtmp(1), wtmp(5), netdate(8L)

---

and that's the whole page, bestie 💖 this lil masterpiece lives in the UNIX Manual as SAC(8) — go forth and account responsibly, and remember: the vibe is immaculate but the bugs are real. mwah 🎀✨