spar - Show Process Accounting Records

'spar' is used to select records from a UNIX process accounting file.
It is usually faster than most 'lastcomm's and significantly more
flexible and powerful:

Timings on SunOS 5.3, with a 2.6MB process accounting file (don't even
think about using lastcomm with this on SunOS 4.x and lots of
accounts, it might finish next week):

Print all records (60,000+) output to /dev/null:
spar-1.2: 28.34 seconds (user+system)
lastcomm: 45.25 seconds

Print all records for a busy user (root; 53,000+ records):
spar-1.2: 23.31 seconds
lastcomm: 36.88 seconds

Print all records for a specific (moderately active) user (3,500+ records):
spar-1.2:  2.14 seconds
lastcomm:  8.01 seconds

Print all records for a basically idle user (no records):
spar-1.2:  0.52 seconds
lastcomm:  5.62 seconds

Examples:

spar -e 'user=root {print}'

spar -e 'user=root && tty != notty && cmd != sh {print}'

spar -e 'cputime > 00:10:00 {print}'

spar -e 'since today 04:00 && before today 05:00 && priv {print}'

'spar' is known to compile and run on SunOS 4.x and SunOS 5.x.  It
should also compile on AIX 3.x, IRIX 4.x, HPUX 7.x, and NeXT 3.x.
Whether it will actually generate the correct output isn't known.
Ports to other systems should be fairly straight forward.  'spar' is
an offspring of the 'extract' utility we use for processing network
TCP and UDP logfiles.  As such, you may see things in the code that
are, uhh, strange (though these could just be due to the author).

To build 'spar':

First look in the 'config' subdirectory for the appropriate
config file for your system.  Then (from the top level directory)

ln -s config/the_config_file config.h

Edit the Makefile to adjust variables to your system, then:

make

This should generate the executable 'spar'.  Note that an ANSI C
compiler is required.   The man page and the 'examples' directory
should get you started.  Also, a script, 'lastcomm.sh' is provided
which works similar to lastcomm, just for comparison.

Suggestions, bugfixes, comments, gripes, etc. should be sent to

Doug.Schales@net.tamu.edu

Enjoy,

Doug.

------------------------------------------------------------------------

Changes from 1.1:

Added optional argument to 'print' action.  This argument is a C
printf style string, allowing one to specify a different style of
output.  See lastcomm.sh, which has been modified to use this in
order to more closely match the output of 'lastcomm'.

Lots of optimization done in order to support above print functionality
without performance hit.  Using the '%' format characters, spar-1.2
is significantly faster than spar-1.1.  The '@' format characters will
slow it down if used.

Included config file for Motorola 88k System V, contributed by
Kevin Johnson, kjj@phx.mcd.mot.com.

------------------------------------------------------------------------

Changes from 1.0:

Fixed hashing bug in tty.c that was causing everything to collide.
Redid tty lookups to improve portability/success rate.
Lots of changes to make porting easier.
Changes to grammar to make date and time handling more accurate
  (handling daylight savings time).  It should work correctly now.
Changes to time handling routines to improve performance.