NAME                                                       SHA(V)
     sha - Shell accounting file

DESCRIPTION
     The file /etc/sha is used by each Shell  to  record  command
     execution	data.  This information	is not used for	charging,
     but is helpful for	system tuning, command design, and  moni-
     toring  of	 user  activity.   For each command executed, the
     Shell writes a 32-byte record of the following form:

     struct {
	  char command_name[8];
	  char login_name[6];
	  char tty_letter;
	  char user_id;
	  long date;
	  long real_time;
	  long cpu_time;
	  long system_time;
     } sh_record;

     The command_name gives the	last (or  only)	 component  of	a
     pathname.	 When  an  asynchronously-executed  command  ter-
     minates, the Shell	can obtain times, but not the actual com-
     mand  name.   In  this case, `**gok' is used.  The	name `()'
     indicates the completion of a parenthesized subshell.

     The type (and therefore volume) of	data recorded in /etc/sha
     can  be controlled	by setting file	permission bits	appropri-
     ately.  If	it cannot be  opened  for  writing,  no	 data  is
     recorded.	 Otherwise,  the  Shell	 tests	the 3 bits of the
     group permission field to determine the kinds  of	recording
     to	 be done.  If a	Shell is reading from a	TTY, it	tests the
     high-order	bit (04).  If it is 0,	the  Shell  records  only
     external commands,	i.e., those not	built into the Shell.  If
     the bit is	1, internal commands (such  as	chdir,	=,  etc.)
     are  also	recorded.  A Shell that	is not reading from a TTY
     uses the two low-order bits.  If bit 02 is	on, external com-
     mands  are	 recorded.   Setting bit 01 on adds internal com-
     mands.  Adm should	own /etc/sha, and the group owner  should
     be	 one  not  used	 elsewhere,  such  as 0.  No data is ever
     recorded for the super-user.  Sample file	modes  and  their
     effects are:

     606  Record external commands issued at TTY.   This  is  the
     preferred mode.

     666  Record everything  but  procedure-level  internal  com-
     mands, which can account for 30% of all command executions.

     676  Record everything.  This mode	is probably  of	 interest
     only  to  those who maintain the Shell.  Be warned	that this
     mode may cause /etc/sha to	grow by	1000 blocks per	day in an
     active system.

SEE ALSO
     sh(I), lastcom(VIII), sa(VIII)