What Commands Are Running and How Long Do They Take? (Unix Power Tools, 3rd Edition)

26.3. What Commands Are Running and How Long Do They Take?

When your system is sluggish, you will want to see what users are on the system along with the processes they're running. To get a brief snapshot of this information, the tersely named w can show you who is logged in, from where, how long they've been idle, and what programs they're running. For instance, when I run w on my Red Hat box at home, I get this result:

  3:58pm  up 38 days,  4:37,  6 users,  load average: 0.00, 0.07, 0.07
USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU  WHAT
jjohn    tty2     -                13Feb02  7:03m  1.32s  0.02s  /bin/sh /usr/X
jjohn    pts/1    :0                8:55am  7:02m  0.06s  0.06s  bash
jjohn    pts/3    :0                8:55am  0.00s 51.01s  0.05s  w
jjohn    pts/0    :0                8:55am  7:02m  0.06s  0.06s  bash
jjohn    pts/4    :0                8:55am  2:25m  2:01   0.12s  bash
jjohn    pts/2    mp3.daisypark.ne Tue 4pm  3:41m  0.23s  0.23s  -bash

Originally, I logged in at the console and started X. Most of the sessions are xterminals except for the last, which is an ssh session. The JCPU field accounts for the CPU time used by all the processes at that TTY. The PCPU simply accounts for the process named in the WHAT field. This is a quick and simple command to show you the state of your system, and it relies on no special process accounting from the kernel.

When you're debugging a problem with a program, trying to figure out why your CPU usage bill is so high [in the days when CPU cycles were rented -- JJ], or curious what commands someone (including yourself) is running, the lastcomm command on Berkeley-like Unixes can help (if your computer has its process accounting system running, that is). Here's an example that lists the user lesleys:

% date
Mon Sep  4 16:38:13 EDT 2001
% lastcomm lesleys
emacs          lesleys  ttyp1      1.41 secs Wed Sep  4 16:28
cat          X lesleys  ttyp1      0.06 secs Wed Sep  4 16:37
stty           lesleys  ttypa      0.02 secs Wed Sep  4 16:36
tset           lesleys  ttypa      0.12 secs Wed Sep  4 16:36
sed            lesleys  ttypa      0.02 secs Wed Sep  4 16:36
hostname       lesleys  ttypa      0.00 secs Wed Sep  4 16:36
quota          lesleys  ttypa      0.16 secs Wed Sep  4 16:35
   ...

The processes are listed in the order completed, most recent first. The emacs process on the tty (Section 2.7) ttyp1 started 10 minutes ago and took 1.41 seconds of CPU time. Sometime while emacs was on ttyp1, lesleys ran cat and killed it (the X shows that). Because emacs ran on the same terminal as cat but finished later, Lesley might have emacs (with CTRL-z) stopped (Section 23.3) to run cat. The processes on ttypa are the ones run from her .cshrc and .login files (though you can't tell that from lastcomm). You don't see the login shell for ttypa (csh) here because it hasn't terminated yet; it will be listed after Lesley logs out of ttypa.

lastcomm can do more. See its manual page.

Here's a hint: on a busy system with lots of users and commands being logged, lastcomm is pretty slow. If you pipe the output or redirect it into a file, like this:

tee Section 43.8

% lastcomm lesleys > lesley.cmds &
% cat lesley.cmds
   ...nothing...
% lastcomm lesleys | tee lesley.cmds
   ...nothing...

the lastcomm output may be written to the file or pipe in big chunks instead of line-by-line. That can make it look as if nothing's happening. If you can tie up a terminal while lastcomm runs, there are two workarounds. If you're using a window system or terminal emulator with a "log to file" command, use it while lastcomm runs. Otherwise, to copy the output to a file, start script (Section 37.7) and then run lastcomm:

% script lesley.cmds
Script started, file is lesley.cmds
% lastcomm lesleys
emacs          lesleys  ttyp1      1.41 secs Wed Sep  4 16:28
cat          X lesleys  ttyp1      0.06 secs Wed Sep  4 16:37
   ...

% exit
Script done, file is lesley.cmds
%

A final word: lastcomm can't give information on commands that are built into the shell (Section 1.9). Those commands are counted as part of the shell's execution time; they'll be in an entry for csh, sh, etc. after the shell terminates.

--JP and JJ