
spar - Show Process Accounting Records

'spar' is used to select records from a UNIX process accounting file.
It is usually faster than most 'lastcomm's and significantly more
flexible and powerful.  

Examples:

spar -e 'user=root {print}'

spar -e 'user=root && tty != notty && cmd != sh {print}'

spar -e 'cputime > 00:10:00 {print}'

'spar' is known to compile and run on SunOS 4.x and SunOS 5.x.  It
should also compile on AIX 3.x, IRIX 4.x, HPUX 7.x, and NeXT 3.x.
Whether it will actually generate the correct output isn't know.
Ports to other systems should be fairly straight forward.  'spar' is
an offspring of the 'extract' utility we use for processing network
TCP and UDP logfiles.  As such, you may see things in the code that
are, uhh, strange (though these could just be due to the author).

To build 'spar':

First look in the 'config' subdirectory for the appropriate
config file for your system.  Then (from the top level directory)

ln -s config/the_config_file config.h
make

This should generate the executable 'spar'.  Note that an ANSI C
compiler is required.   The man page and the 'examples' directory
should get you started.  Also, a script, 'lastcomm.sh' is provided
which works similar to lastcomm, just for comparison.

Suggestions, bugfixes, comments, gripes, etc. should be sent to

Doug.Schales@net.tamu.edu

Enjoy,

Doug.
------------------------------------------------------------------------

Changes from 1.0:

Fixed hashing bug in tty.c that was causing everything to collide.
Redid tty lookups to improve portability/success rate.
Lots of changes to make porting easier.
Changes to grammar to make date and time handling more accurate
  (handling daylight savings time).  It should work correctly now.
Changes to time handling routines to improve performance.
