The accounting database files are located in the /var/adm directory and include the following files:

The accounting scripts and commands access the records in the accounting database files and reformat them so that you can use the records for purposes such as archiving, diagnostic analysis, or resource billing.

The various accounting shell scripts and commands also can do the following:

• Format the database file records

• Create new source files from the database file records

• Display the database file records

• Merge data from several files into a single formatted file

• Summarize data in files that you can use to create reports

You can redirect or pipe script and command output to files or to other scripts and commands.

Note

You must install the System Accounting Utilities subset to use accounting.

To obtain accounting information for all the machines in a network, you should set up accounting on a single machine. Use the following procedure to enable system accounting. The sections that follow describe these steps in detail.

1. Enable accounting in the /etc/rc.config file.

2. Create the /var/adm/qacct and /var/adm/pacct files.

3. Edit the /usr/sbin/acct/holidays file to specify prime time, nonprime time, and holidays.

4. To enable automatic accounting, modify the files in the /usr/spool/cron/crontabs directory to invoke accounting shell scripts and commands.

ACCOUNTING="YES"

You can use the rcmgr command to set the variable, as follows:

# rcmgr  set  ACCOUNTING  YES

If the /usr/sbin/acct/holidays file does not exist, you must create it. If the file exists, you must edit it to reflect your accounting needs.

You can set the NHOLIDAYS environment variable to specify the maximum number of holidays that you can include in the holidays file.

You can include the following commands and shell scripts in the /usr/spool/cron/crontabs/adm file:

ckpacct

This shell script checks the size of the /var/adm/pacct process accounting database file and ensures that it does not become too large.

runacct

This shell script includes other accounting shell scripts and commands and creates daily and monthly accounting files. You can modify the runacct shell script to remove the commands for the accounting features that you do not want.

monacct

This shell script creates monthly summary accounting files. You can modify the monacct shell script to remove the commands for the accounting features that you do not want.

Connect session commands can convert the /var/adm/wtmp file records to useful connect session accounting records. You can obtain connect session accounting only if the /var/adm/wtmp file exists.

The formatted records in the /var/adm/wtmp file provide the following information about each connect session:

• User login name (from the /etc/passwd file)

• Line identification number (from the /etc/inittab file)

• The device name (for example, console or tty23 )

• Type of entry

• Process identification number

• Process termination status

• Process exit status

• Time entry was made

• Host machine name

You can use the following two shell scripts and seven commands to obtain or modify information about system connect sessions:

The /usr/include/utmp.h header file structure is the record format for the following connect session files:

• /var/adm/wtmp

• /var/adm/utmp

• /var/adm/acct/nite/wtmp.mmdd

• /var/adm/acct/nite/ctmp

The /usr/sbin/acct/wtmpfix command corrects date and time stamp inconsistencies in files with the utmp.h header file structure and displays the records. The runacct script invokes the wtmpfix command.

Each time a date is entered in the /var/adm/wtmp file (for example, at system startup or by using the date command), a pair of date-change records is also written to the wtmp file. The first date-change record is the old date, which is specified in the ut_line and ut_type fields. The second date-change record is the new date, which is also specified in the ut_line and ut_type fields. The wtmpfix command uses these records to synchronize all date and time stamps in the /var/adm/wtmp file, and then the date-change record pair is removed. The date-change records never appear in an output file.

The wtmpfix command also checks the validity of the user name field (the ut_user field) to ensure that the name consists only of alphanumeric characters, a dollar sign ($), or spaces. If an invalid name is detected, the wtmpfix command changes the login name to INVALID and displays a diagnostic message.

The wtmpfix command has the following syntax:

/usr/sbin/acct/wtmpfix[filename]. . .

The filename variable specifies the name of the input file. The default input file is the /var/adm/wtmp binary file.

The acctwtmp command has the following syntax:

/usr/sbin/acct/acctwtmpreason

The reason variable must have a maximum of sizeof(ut_line) characters and be enclosed in quotation marks (" ").

The acctcon1 command has the following syntax:

/usr/sbin/acct/acctcon1[-l file] [ -o file] [-pt]

You must direct a file as input to the command. Refer to the acctcon1(8) reference page for information on command options.

The following example produces a sample /var/adm/acct/reboots file. It writes records to a file in ASCII overall-record format, which specifies a starting time, an ending time, the number of restarts, and the number of date changes.

# acctcon1 -o overall_file < /var/adm/wtmp | more overall_file
from Thu Jan  13 17:20:12 1994 EDT
to   Fri Jan  14 09:56:42 1994 EDT
2   date changes
2   acctg off
0   run-level S
2   system boot
2   acctg on
1   acctcon1

/usr/sbin/acct/prctmp[filename]

Refer to the prctmp(8) reference page for more information.

The runacct shell script invokes the lastlogin shell script during its CMS state. You can invoke the lastlogin shell script manually to update the /var/adm/acct/sum/loginlog file, which is included in the /var/adm/acct/sum/rprtmmdd daily report.

The lastlogin shell script has the following syntax:

/usr/sbin/acct/lastlogin

• Time that the session began

• Duration of the session

• tty terminal on which the session took place

The following information is included when applicable:

• Terminations when rebooting

• Continuing sessions

The last command has the following syntax:

/usr/bin/last[-#] [username . . .] [tty . . .]

By default, all records are displayed. You can specify a user name and a terminal for which you want to display records.

The following example displays information only about the three previous root logins:

# last -3 root
root    ttyp1     shout     Fri Jan 21 10:56   still logged in
root    ttyp1     raven     Fri Jan 21 08:59 - 09:00  (00:00)
root    ttyp0     raven     Thu Jan 20 15:29 - 15:54  (00:24)

The /var/adm/pacct file will grow in size. The ckpacct command checks the size of the /var/adm/pacct file and creates a /var/adm/pacctn file if the pacct file is larger than a specified size.

The /var/adm/pacct database file includes the following process information:

• Process type (for example, child process)

• Exit status indicating how the process terminated

• User identification number

• Group identification number

• Terminal from which the process originated

• Start, user, system, and CPU time

• Amount of memory used

• Number of I/O characters transferred

• Number of 1024-byte blocks read or written

• Name of the command used to start the process

The record format for the process accounting files is tacct format and is established by the acct header file structure. The acct header file structure is defined in the /usr/include/sys/acct.h header file and includes up to 18 columns of accounting information. The tacct structure members are defined in the private tacct.h header file.

/usr/sbin/acct/accton[filename]

If you do not specify the filename variable, process accounting is disabled. If you specify the filename variable, process accounting is turned on and the kernel writes process accounting records to the specified file. Usually, this file is the /var/adm/pacct file; however, you can specify a different process accounting database file. The file must exist in the /var/adm directory, be owned by user adm, and be a member of the adm login group.

Note

The runacct and turnacct shell scripts use the /var/adm/pacct process accounting database file. If you specify a process accounting database file other than the /var/adm/pacct file, the runacct and turnacct shell scripts will be affected.

turnacct[on | off | switch ]

The acctcom command displays information only about processes that have terminated; use the ps command to display information about active processes. The acctcom command has the following syntax:

/usr/bin/acctcom[option . . .] [filename . . .]

If you do not specify the filename variable, the command uses the /var/adm/pacct file to obtain the process accounting records. You can use the filename variable to specify a different process accounting file that has the acct.h header file structure. If you specify more than one filename variable, the acctcom command reads the files in chronological order.

If you do not specify any command options, the default output includes the following information in a column heading format:

• Time and date that accounting was enabled

• Command name

• User name

• tty name

• Process start time

• Process end time

• Real seconds

• CPU seconds

• Mean memory size (in kilobytes)

Refer to the acctcom(8) reference page for information on the command options.

The following is an example of the default process accounting summary output:

# /usr/bin/acctcom  /var/adm/pacct1
ACCOUNTING RECORDS FROM: Mon Jan 17 02:00:00 1994
COMMAND                  START    END        REAL   CPU    MEAN
NAME     USER   TTYNAME  TIME     TIME      (SECS) (SECS) SIZE(K)
#sa      root   ttyp1    11:59:00 11:59:00   0.77   0.01   0.00
ls       root   ttyp1    11:59:04 11:59:04   0.11   0.01   0.00
uugetty  root   ?        11:58:39 11:59:48  69.53   0.01   0.00
#ls      root   ttyp1    11:59:55 11:59:55   0.30   0.01   0.00
uugetty  root   ?        11:59:49 12:00:58  69.48   0.01   0.00
cp       adm    ?        12:05:01 12:05:01   0.33   0.01   0.00
chmod    adm    ?        12:05:01 12:05:01   0.27   0.01   0.00
#df      adm    ?        12:05:02 12:05:02   0.38   0.01   0.00
awk      adm    ?        12:05:02 12:05:02   0.58   0.01   0.00
sed      adm    ?        12:05:02 12:05:02   0.56   0.01   0.00

/usr/sbin/sa[options . . .] [filename]

The filename variable specifies a process accounting file with the acct.h header file structure. If the filename variable is not specified, the /var/adm/pacct file is used.

If you invoke the sa command with no options, the default output consists of six unheaded columns. Certain command options allow you to expand the six columns to include more information. You can specify options to change the format and to output additional information that includes an identifying suffix. Refer to the sa(8) reference page for information on the command options.

The following example shows the default format of the output of the sa command:

The runacct shell script invokes the acctcms command during its CMS state. You can also invoke this command manually to create a command summary report.

The acctcms command has the following syntax:

/usr/sbin/acct/acctcms[-acjnopst] filename . . .

If you invoke the acctcms command with no options, the command sorts the output in descending order according to total kcore minutes, which is the number of kilobytes of memory used by the process multiplied by the buffer time used. Binary output is the default. Use the following calculation to obtain the kcore minutes:

kcoremin=[(CPU time in seconds)*(mean memory size in kbyte)]/60

Note

If you use the acctcms command to produce a total summary file in ASCII format, each command record will consist of more than 80 characters, and the entire width of 8.5 x 11-inch paper could be used if the 10-character per inch constant-width font is specified. If part of a record exceeds the column width, it is moved to the next line.

The following example produces ASCII output that includes the statistics for commands that were invoked only once in a row specifying ***other in the COMMAND NAME column:

# acctcms -a -j /var/adm/pacct1
                        TOTAL COMMAND SUMMARY
COMMAND NUMBER TOTAL  TOTAL  TOTAL   MEAN  MEAN   HOG    CHARS  BLOCKS
NAME    CMDS KCOREMIN CPUMIN REALMIN SIZEK CPUMIN FACTOR TRNSFD READ

TOTALS  9377  0.00    0.36  26632.67 0.00  0.00   0.00 17768213 100529

chmod     34  0.00    0.00       .15 0.00  0.00   0.07  5785856    64
ln         4  0.00    0.00      0.01 0.00  0.00   0.78   422016    16
xterm      9  0.00    0.03    537.41 0.00  0.00   0.00 22948288   536
getcons    8  0.00    0.00      0.14 0.00  0.00   0.07 26636992   102
cfe2.20    4  0.00    0.00      0.09 0.00  0.00   0.12   182464   155
dump      22  0.00    0.00     14.91 0.00  0.00   0.00 69402112   128
whoami     4  0.00    0.00      0.03 0.00  0.00   0.36  7405952    27
restore   40  0.00    0.00     49.16 0.00  0.00   0.00 34247488  1316
***other  25  0.00    0.00   3546.88 0.00  0.00   0.00 35904984   737
hostname   2  0.00    0.00      0.01 0.00  0.01   0.94   223104    14

If your system has users with the same user identification number, you should use a process accounting file in the /var/adm/acct/nite directory instead of the /var/adm/pacct file.

The runacct shell script invokes the acctprc1 command during its PROCESS state. You can also invoke the command manually. The acctprc1 command has the following syntax:

/usr/sbin/acct/acctprc1[filename]

The filename variable specifies a file that contains a list of login sessions in a format defined by the /usr/include/utmp.h header file structure. If the filename variable is not specified, login names are obtained from the /etc/passwd file.

The command output specifies information in a format with seven unheaded columns that specify the following:

• User identification number

• Login name

• Number of CPU seconds the process used during prime time

• Number of CPU seconds the process used during nonprime time

• Total number of characters transferred

• Total number of blocks read from and written to

• Mean memory size (in kilobytes)

The following is an example of the acctprc1 command and its output:

# /usr/sbin/acct/acctprc1  < /usr/adm/pacct
   0   root      0     1   17228   172    6
   4   adm       0     6   46782    46   16
   0   root      0    22  123941   132   28
9261   hoffmann  6     0   17223    22   20
   9   lp        2     0   20345    27   11
9261   hoffmann  0   554   16554    20  234

The following information is displayed for each process:

• Command name

• Either the S flag, which specifies that the command was invoked by the superuser; or the F flag, which specifies that the command ran after a fork but was not followed by an exec system call

• Name of the user who issued the command

• Terminal from which the command was started

• Number of seconds of CPU time used

• Time the process started

The lastcomm command has the following syntax:

/usr/bin/lastcomm[command] [username] [tty]

The following example displays information about the sed commands executed by root:

# lastcomm sed root
sed      S  root     ttyp0      0.01 secs Fri Jan 21 11:34
sed      S  root     ttyp0      0.01 secs Fri Jan 21 11:34

You can combine the total accounting information in the /var/adm/acct/nite/dacct file with other accounting information to create complete accounting reports. For example:

# /usr/sbin/acct/dodisk

# /usr/sbin/acct/prtacct /var/adm/acct/nite/dacct

/usr/sbin/acct/dodisk[-o] [filesystem . . .]

/usr/sbin/acct/dodisk[device special file . . .]

Using the -o option, you can specify the file system variable to perform disk usage accounting on the mount point of a UFS file system or an AdvFS fileset. If the -o option is not specified, the variable must be the raw or character device special file. For example:

# /usr/sbin/acct/dodisk /dev/rrz3c

Note

If you have a swap space specified in the /etc/fstab file, the dodisk shell script will not execute correctly. In this case, you can edit the dodisk shell script to use only specific file systems or you can invoke the dodisk shell script and specify the file systems for which you want accounting.

If you specify the -o option, the dodisk shell script uses the acctdusg command instead of the diskusg command to perform a more thorough but slower version of disk accounting. If you specify the -o option and a filesystem variable, specify the mount point instead of the device special file name.

/usr/sbin/acct/diskusg[-options] [filesystems]

Refer to the diskusg(8) reference page for information on the command options.

The diskusg command produces ASCII output, which is directed to the /var/adm/dtmp file. This file is used as input to the acctdisk command, which converts the ASCII records to binary total accounting records in the /var/adm/acct/nite/dacct file. You can merge these records with other accounting records to create a daily total accounting report.

Each output record produced by the diskusg command contains the user identification number, login name, and the total number of disk blocks allocated to the user. Because the diskusg command checks user inode records, all disk space is accounted for, including empty directories.

The following is an example of the diskusg command:

# /usr/sbin/acct/diskusg  /dev/rrz3c
   0   root        63652
   1   daemon         84
   2   bin         71144
   4   adm           976
   5   uucp         3324
 322   homer           2
 521   whistler        2
 943   cellini       363
1016   pollock        92
1098   hopper        317

You must specify the raw device special file for filesystem (for example, /dev/rrz3c). A file system must exist on the target device.

The acctdusg command performs more thorough disk accounting than the diskusg command. If dodisk is invoked with the -o option, the acctdusg command is used to create the /var/adm/dtmp file.

The acctdusg command has the following syntax:

acctdusg[-u filename] [-p filename]

Refer to the acctdusg(8) reference page for information on the command options.

You must direct a binary disk usage file, usually /var/adm/dtmp, to the command. If the dodisk shell script invokes the command, the acctdusg command uses the file systems specified with the dodisk script as input.

The input to the acctdusg command is usually a list of files piped from a find / -print command. The command compares the file pathnames to the users' login directories ($HOME). If a file pathname is the same as a user's login directory, that user is charged for the file. Therefore, the directory in which the file is located is the determining factor in charging users for disk space. You can use the -u option to display the number of disk blocks used by files in directories other than the login directories.

For each file, the acctdusg command calculates the computed value, which is the number of disk blocks (including hidden or indirect blocks) that are allocated to the file divided by the number of hard links. If two or more users have links to the same file, the acctdusg command charges each user an equal percentage of the file's total disk space.

The acctdusg command output displays the user identification number, the user name, and the sum of the computed values of all the files owned by the user in three columns and adds leading 0s (zeros) to the user identification number. The acctdusg command does not display the disk-block count for empty directories.

The disk usage accounting records produced by the acctdisk command are usually merged with other accounting records to produce a total accounting report.

• Backing up files to disk

• Recovering files from disk

• Backing up files to tape

• Recovering files from tape

• Providing software technical assistance by phone

• Providing software technical assistance in person

• Name of the host and user that issued the print request

• Number of pages or feet of medium printed

• Number of times the printer was used

• Price per unit of printed output

The printer accounting records enable you to charge users for the system printing resources and to track printer usage.

The /var/adm/acct/nite directory contains files that are reused daily by the runacct script. Some of these files have binary counterparts in the /var/adm/acct/sum directory, which contains the cumulative summary files that are updated by the runacct shell script and used by the monacct shell script to produce monthly reports.

You can set up the cron daemon to invoke the runacct shell script each day, or you can invoke the runacct shell script manually. You may have to invoke the command manually if the runacct shell script does not complete or if a file created by the script becomes corrupted or lost.

Note

When you invoke the runacct shell script it creates the /var/adm/acct/nite/lock temporary file. If the /var/adm/acct/nite/lock file exists, the runacct shell script will not run.

The runacct shell script executes in the following 13 states, in the order listed, and can be restarted at any of the 13 states:

ERROR: locks found. run aborted

A /var/adm/acct/nite/lock file exists. Remove the file and restart the runacct shell script from its last completed state.

ERROR: acctg already run for Fri : check Jan

The current date is the same as the date specified in the /var/adm/acct/nite/lastdate file. Remove the file and restart the runacct shell script from its last completed state.

ERROR: runacct called with invalid arguments

You have specified invalid arguments with the runacct shell script.

ERROR: turnacct switch returned rc=?

The accton command failed when it was invoked by the turnacct switch shell script. Check the accton command protections and ensure that user adm can invoke the command.

ERROR: Spacct?.mmdd already exists run setup manually

You must invoke the runacct shell script manually from the MERGE state.

ERROR: wtmpfix errors see nite/wtmperror

An unrepairable wtmp file was found during the WTMPFIX state. Use the fwtmp command to correct the file.

ERROR: invalid state, check /usr/var/adm/nite/active

During processing, the runacct shell script may have detected a corrupted active file. Check the /var/adm/acct/nite/active* and statefile files.

The default command output is in binary format, but you can also produce ASCII output. The default acctmerg command output has the /usr/include/sys/acct.h header file structure and includes up to 18 columns of accounting information. Records with the /usr/include/sys/acct.h header file structure that include data types specified as an array of two double elements can have both prime time and nonprime time values.

The monacct and prdaily shell scripts invoke the prtacct shell script. The runacct shell script invokes the prdaily shell script during its CLEANUP state. The prtacct shell script has the following syntax:

/usr/sbin/acct/prtacct[-f column] [-v] file

Refer to the prtacct(8) reference page for information on the command options.

The prdaily script combines information from the following six accounting files:

• /var/adm/acct/nite/reboots

• /var/adm/acct/nite/lineuse

• /var/adm/acct/sum/tacctmmdd

• /var/adm/acct/nite/daycms

• /var/adm/acct/nite/cms

• /var/adm/acct/sum/loginlog

The prdaily shell script has the following syntax:

prdaily[-l[ mmdd]] | [-c]

Refer to prdaily(8) for more information on command options.