12    Administering the System Accounting Services

By using the accounting services, you can obtain accounting information for the following:

• Amount of connect time

• Amount of CPU time

• Number of processes spawned

• Number of connect sessions

• Amount of memory usage

• Number of I/O operations and number of characters transferred

• Disk space usage (in blocks)

• Amount of modem usage and telephone connect time

• Printer usage, including the number of printing operations and amount of printed matter, according to user name or printer name

You can set up accounting so that information is collected automatically on a periodic basis. You can also manually invoke accounting shell scripts and commands to obtain accounting information when you need it.

12.1    Accounting Overview

If accounting is enabled, the kernel and other system processes write records to the accounting database files, which are the source of all the accounting information.

The accounting database files are located in the /var/adm directory and include the following files:

File	Description
wtmp	The login/logout history file
utmp	The active connect session file
pacct	The active process accounting file
dtmp	The disk usage file

The accounting scripts and commands access the records in the accounting database files and reformat them so that you can use the records for purposes such as archiving, diagnostic analysis, or resource billing.

The various accounting shell scripts and commands also can do the following:

• Format the database file records

• Create new source files from the database file records

• Display the database file records

• Merge data from several files into a single formatted file

• Summarize data in files that you can use to create reports

You can redirect or pipe script and command output to files or to other scripts and commands.

System accounting allows you to distinguish between prime time and nonprime time. The system is used most during prime time and least during nonprime time. System use during nonprime time can be assessed at a lower rate than system use during prime time. You specify the period of nonprime time in the /usr/sbin/acct/holidays database file. Usually, if enabled, automatic accounting is performed during nonprime time.

The accounting period begins when the /var/adm/pacct file is created by the startup shell script when accounting is turned on or by the runacct script, which is usually run every day.

In command output, the order of date and time information is site dependent. You can change the order of date and time specifications by setting the NLTIME environment variable.

12.1.1    Accounting Shell Scripts and Commands

There are 14 accounting shell scripts and 20 accounting commands. The shell scripts often call the accounting commands or other shell scripts. The accounting commands and shell scripts create and write records to the accounting database files. Table 12-1 describes the accounting commands and shell scripts.

Table 12-1: Accounting Commands and Shell Scripts

12.1.2    Accounting Files

Many binary and ASCII files are created and maintained by the kernel or by the accounting commands and shell scripts.

You should ensure that the accounting files, particularly those in binary format, do not become too large. Some extraneous files are produced by the accounting commands and shell scripts, but in general these files are temporary and exist only while the process is running. Under some circumstances (if a process terminates prematurely, for example), one or more temporary files can appear in one of the /var/adm subdirectories. You should check these subdirectories periodically and remove the unnecessary files.

Accounting files can become corrupted or lost. The files that are used to produce daily or monthly reports, such as the /var/adm/wtmp and /var/adm/acct/sum/tacct accounting database files, must have complete integrity. If these files are corrupted or lost, you can recover them from backups. In addition, you can use the fwtmp or the wtmpfix command to correct the /var/adm/wtmp file. Refer to Section 12.4.2 and Section 12.4.1 for more information. You can use the acctmerg command to fix errors in the /var/adm/acct/sum/tacct file. Refer to Section 12.9.2 for more information.

The /var/adm/acct/nite directory contains files that are reused daily by the runacct script. Some of these files have binary counterparts in the /var/adm/acct/sum directory, which contains the cumulative summary files that are updated by the runacct shell script and used by the monacct shell script to produce monthly reports.

Table 12-2 to Table 12-5 list the accounting files. The Name column specifies the file name and the table title specifies the directory pathname for the files. The Type column tells you if the file is an ASCII file or a binary file. The Description column provides a description of the file.

Table 12-2: Database Files in the /var/adm Directory

Table 12-3: Daily Files in the /var/adm/acct/nite Directory

Table 12-4: Summary Files in the /var/adm/acct/sum Directory

Table 12-5: Monthly Files in the /var/adm/acct/fiscal Directory

12.2    Setting Up Accounting

In a system environment where many users compete for system resources, Digital UNIX system accounting allows you to track system use. You must decide the quantity and type of information that you want to track. You also must decide if you want to enable automatic accounting. To enable automatic accounting, you specify accounting commands and shell scripts in the files in the /usr/spool/cron/crontabs directory.

Note

You must install the System Accounting Utilities subset to use accounting.

To obtain accounting information for all the machines in a network, you should set up accounting on a single machine. Use the following procedure to enable system accounting. The sections that follow describe these steps in detail.

1. Enable accounting in the /etc/rc.config file.

2. Create the /var/adm/qacct and /var/adm/pacct files.

3. Edit the /usr/sbin/acct/holidays file to specify prime time, nonprime time, and holidays.

4. To enable automatic accounting, modify the files in the /usr/spool/cron/crontabs directory to invoke accounting shell scripts and commands.

Resource accounting is discussed separately from printer accounting because the print driver software uses different servers, daemons, and routines. Setting up printer accounting is described in Chapter 10.

12.2.1    Enabling Accounting in the rc.config File

To enable accounting, you must add the following line to the /etc/rc.config file:

ACCOUNTING="YES"

You can use the rcmgr command to set the variable, as follows:

#  rcmgr  set  ACCOUNTING  YES

You can start accounting without rebooting your system by using the startup command. Refer to Section 12.3 for more information.

12.2.2    Creating the qacct and pacct Files

You must create the /var/adm/qacct queueing accounting file and the /var/adm/pacct process accounting database file. Use the nulladm command to create the files.

12.2.3    Editing the holidays File

The /usr/sbin/acct/holidays file uses 24-hour time to specify prime time and nonprime time. The file also specifies holidays, which are included in nonprime time. Only the days Monday through Friday are included in prime time. You can assess system use during nonprime time at a lower rate than during prime time. If you enable automatic accounting, you should specify that the commands be executed during nonprime time.

If the /usr/sbin/acct/holidays file does not exist, you must create it. If the file exists, you must edit it to reflect your accounting needs.

You can set the NHOLIDAYS environment variable to specify the maximum number of holidays that you can include in the holidays file.

12.2.4    Modifying the crontab Files

To enable automatic accounting, you must use the crontab command to modify the files in the /usr/spool/cron/crontabs directory. The files in the /usr/spool/cron/crontabs directory contain commands that the cron daemon runs at specified times under a specific authority. For example, the commands in the /usr/spool/cron/crontabs/root file are run under root authority, and the commands in the /usr/spool/cron/crontabs/adm file are run under adm authority.

You can include the following commands and shell scripts in the /usr/spool/cron/crontabs/adm file:

ckpacct

This shell script checks the size of the /var/adm/pacct process accounting database file and ensures that it does not become too large.

runacct

This shell script includes other accounting shell scripts and commands and creates daily and monthly accounting files. You can modify the runacct shell script to remove the commands for the accounting features that you do not want.

monacct

This shell script creates monthly summary accounting files. You can modify the monacct shell script to remove the commands for the accounting features that you do not want.

ac

This command displays connect-time records. You can direct the output to a file. You can also add this command to the runacct shell script.

pac

This command displays printer accounting records. You can direct the output to a file. To enable printer accounting, refer to Section 12.8.

You can include the dodisk shell script in the /usr/spool/cron/crontabs/root file. The dodisk shell script creates disk usage accounting records and should be run once during nonprime time each week.

Refer to Chapter 3 and to the crontab(1) reference page for more information on submitting commands with the crontab command.

The following example shows part of a /usr/spool/cron/crontabs/adm file that includes accounting commands and shell scripts:

0 2 * * 1-6 /usr/sbin/acct/runacct  > /usr/adm/acct/nite/fd2log&
5 * * * * /usr/sbin/acct/ckpacct&
0 4 1 * *  /usr/sbin/acct/monacct&
10 3 * * * /usr/sbin/ac -p > /var/adm/timelog&
40 2 * * * /usr/sbin/pac -s&

The following example shows part of a /usr/spool/cron/crontabs/root file that includes the dodisk shell script:

0 3 * * 4 /usr/sbin/acct/dodisk  > /var/adm/diskdiag&

12.3    Starting Up and Stopping Accounting

The startup and shutacct shell scripts enable and disable the various accounting processes. The scripts invoke the acctwtmp program, which adds a record to the /var/adm/wtmp file by using the system name as the login name.

The startup shell script initializes the accounting functions and has the following syntax:

/usr/sbin/acct/startup

Note

You must ensure that the /var/adm/pacct file, which is created by the startup script, is owned by group adm and user adm and has 664 protection. If it does not have the correct ownership, the accton command will not work, and the following message will be displayed:

accton: uid/gid not adm

The shutacct script turns process accounting off and ensures that the accounting functions are halted before the system shuts down. The shutacct shell script has the following syntax:

/usr/sbin/acct/shutacct [ 'Reason' ]

If the shutacct shell script is invoked, the 'Reason' message is written to the ut_line field in the /var/adm/wtmp file shutdown record. Then, the turnacct off shell script is invoked to tell the kernel that its active accounting functions should be disabled.

12.4    Connect Session Accounting

When a user logs in or logs out, the login and init commands write the user login and logout history to records in the /var/adm/wtmp binary database file. The /var/adm/utmp binary database file is the active connect session file. All hangups, terminations of the login command, and terminations of the login shell cause the system to write logout records, so the number of logouts is often more than the number of sessions.

Connect session commands can convert the /var/adm/wtmp file records to useful connect session accounting records. You can obtain connect session accounting only if the /var/adm/wtmp file exists.

The formatted records in the /var/adm/wtmp file provide the following information about each connect session:

• User login name (from the /etc/passwd file)

• Line identification number (from the /etc/inittab file)

• The device name (for example, console or tty23 )

• Type of entry

• Process identification number

• Process termination status

• Process exit status

• Time entry was made

• Host machine name

You can use the following two shell scripts and seven commands to obtain or modify information about system connect sessions:

Command	Description
ac	This command displays connect session records for the entire system and for each user.
acctcon1	This command summarizes connect session records and displays those records in ASCII format, using one line for each connect session.
acctcon2	This command uses the output of the acctcon1 command to produce an accounting record file of the total connect session in ASCII format.
acctwtmp	This command enables you to write records to the wtmp file by entering them from the keyboard.
fwtmp	This command displays records from files with the utmp.h file structure.
last	This command displays login information.
lastlogin	This shell script updates the /var/adm/acct/sum/loginlog file to show the last date that each user logged in.
prctmp	This shell script displays the contents of the session-record file (usually /var/adm/acct/nite/ctmp) that the acctcon1 command created.
wtmpfix	This command corrects the wtmp connect session records that are affected by a date modification and validates login names written to the login name field in the wtmp file.

The /usr/include/utmp.h header file structure is the record format for the following connect session files:

• /var/adm/wtmp

• /var/adm/utmp

• /var/adm/acct/nite/wtmp.mmdd

• /var/adm/acct/nite/ctmp

The /usr/include/utmp.h header file structure includes nine fields. Table 12-6 shows the utmp ASCII conversion format for the field number, member name in the header file structure, its description and, if necessary, character length.

Table 12-6: The utmp ASCII Conversion Structure Members

12.4.1    The wtmpfix Command

The /usr/sbin/acct/wtmpfix command corrects date and time stamp inconsistencies in files with the utmp.h header file structure and displays the records. The runacct script invokes the wtmpfix command.

Each time a date is entered in the /var/adm/wtmp file (for example, at system startup or by using the date command), a pair of date-change records is also written to the wtmp file. The first date-change record is the old date, which is specified in the ut_line and ut_type fields. The second date-change record is the new date, which is also specified in the ut_line and ut_type fields. The wtmpfix command uses these records to synchronize all date and time stamps in the /var/adm/wtmp file, and then the date-change record pair is removed. The date-change records never appear in an output file.

The wtmpfix command also checks the validity of the user name field (the ut_user field) to ensure that the name consists only of alphanumeric characters, a dollar sign ($), or spaces. If an invalid name is detected, the wtmpfix command changes the login name to INVALID and displays a diagnostic message.

The wtmpfix command has the following syntax:

/usr/sbin/acct/wtmpfix [ filename... ]

The filename variable specifies the name of the input file. The default input file is the /var/adm/wtmp binary file.

12.4.2    The fwtmp Command

The fwtmp command allows you to correct wtmp files. The command converts binary records from files with the utmp.h header file structure to formatted ASCII records. You can edit the ASCII version of a wtmp file to repair bad records or for general file maintenance. Table 12-6 shows the ASCII structure you should use.

During system operation, date changes and reboots occur, and the records are written to the /var/adm/wtmp file. The wtmpfix command adjusts the time stamps in the /var/adm/wtmp file; however, some corrections can evade detection by the wtmpfix command and cause the acctcon command to fail. In this case, you can correct the /var/adm/wtmp file by using the fwtmp command.

The fwtmp command has the following syntax:

/usr/sbin/acct/fwtmp [ -ic ]

The fwtmp file uses standard input, or you can direct a file to the command.

If no options are specified with the fwtmp command, binary records are converted to ASCII records. Refer to the fwtmp(8) reference page for information on command options.

If you want to enter /usr/include/utmp.h header file records manually, you must enter data in each of the nine fields in the order used by the utmp ASCII structure members, as shown in Table 12-6. All record-field entries that you enter from the keyboard must be separated by a space. Also, you must specify all the string fields by using blank characters, if necessary, up to the maximum string size. All decimal values must be specified with the required number of decimal places, using preceding 0s (zeros) to indicate the empty digit positions.

The following example converts the /var/adm/wtmp binary file records to ASCII records:

#  /usr/sbin/acct/fwtmp  <  /var/adm/wtmp

           system boot  0 20000 0000 652547412 Jan 5 11:10:12 1994
           system boot  0 10062 0123 652547412 Jan 5 11:10:12 1994
bcheck  bl              6 80000 0000 652547413 Jan 5 11:10:13 1994
cat     cr             16 80000 0000 652547414 Jan 5 11:10:14 1994
rc      rc             17 80000 0000 652547485 Jan 5 11:11:25 1994
hoffman co console    147 70000 0001 652547495 Jan 5 11:11:35 1994
hoffman p4 pty/ttyp4 2156 80000 0002 652650095 Jan 6 15:41:35 1994
LOGIN   p4 pty/ttyp4 2140 60000 0000 652649075 Jan 6 15:24:35 1994
LOGIN   p4 pty/ttyp4 2140 80000 0000 652649086 Jan 6 15:24:46 1994

To correct a /var/adm/wtmp file:

1. Change your working directory to /var/adm/acct/nite.

2. Use the fwtmp command to create an ASCII version of the wtmp file.

   #  fwtmp < wtmp.0617 > wtmp_temp
   

3. Edit the temporary file and remove the corrupted records.

4. Use the fwtmp command to re-create the wtmp file.

   #  fwtmp -ic < wtmp_temp > wtmp.0617
   

12.4.3    The acctwtmp Command

The acctwtmp command allows you to write a reason string and the current time and date to a utmp.h structured file, usually the /var/adm/wtmp file. The runacct, startup, and shutacct shell scripts invoke the acctwtmp command to record when the runacct script is invoked and when system accounting is turned on and off.

The acctwtmp command has the following syntax:

/usr/sbin/acct/acctwtmp reason

The reason variable must have a maximum of sizeof(ut_line) characters and be enclosed in quotation marks (" ").

12.4.4    The ac Command

The ac command displays connect session records from files with the utmp file structure shown in Table 12-6. You can use the command to perform system diagnostics and determine user charges. The ac command displays the total connect time for all users or the total connect time for the specified users. The connect time is given in hours rounded to the nearest hundredth. To automatically generate total user connect session files, you can include the ac command in the /usr/spool/cron/crontab/adm file or modify the runacct shell script and include the ac command. Refer to Section 12.2.4 for information on setting up automatic accounting.

The ac command has the following syntax:

/usr/sbin/ac [ -d ] [ -p ] [ -w filename ] [ username ... ]

Refer to the ac(8) reference page for information on command options.

The default behavior displays the sum of the system connect time for all users. For example:

#  /usr/sbin/ac

 "total 48804.26"

The following command displays the total connect time according to user name:

#  /usr/sbin/ac  -p 

buckler     61.44
fujimori   530.94
newsnug    122.38
dara         0.10
root       185.98
buchman    339.33
russell     53.96
hoff       200.43
hermi      157.81
total     1968.02

The total connect time for all users listed is shown in the last line.

12.4.5    The acctcon1 Command

The acctcon1 command converts binary session records from a file with the utmp.h header file structure to ASCII format. A single record is produced for each connect session. The runacct shell script uses the acctcon1 command to create the lineuse and reboots files, which are included in the /var/adm/acct/sum/rprtmmdd daily report.

The acctcon1 command has the following syntax:

/usr/sbin/acct/acctcon1 [ -l file ] [ -o file ] [ -pt ]

You must direct a file as input to the command. Refer to the acctcon1(8) reference page for information on command options.

The following command line provides an example of a /var/adm/acct/nite/lineuse file. It writes records to the specified file in ASCII line-usage format, which helps you to track line usage and to identify bad lines; and it includes the reference designation of the ports that the user logged in to and the date and time stamp of the currently active connect session.

#  acctcon1 -l line_file < /var/adm/wtmp | more line_file

TOTAL DURATION IS 57 MINUTES
LINE         MINUTES      PERCENT    # SESS   # ON   # OFF
pty/ttyp4         37           64        3      3       7
console           26           45        2      2       4
pty/ttyp5          7           11        1      1       3
pty/ttyp6          0            0        0      0       2
TOTALS            69            -        6      6      16

In the previous example, the ASCII line-usage format specifies the following:

• Total number of minutes that the system was in multiuser state

• The line name

• The number of session minutes used during the accounting period

• The ratio of minutes in use to the total duration

• The number of times the port was accessed (fourth and fifth columns)

• The number of logouts and any other interrupts on the line

You can compare the last column to the fourth column to determine if a line is bad.

The following example produces a sample /var/adm/acct/reboots file. It writes records to a file in ASCII overall-record format, which specifies a starting time, an ending time, the number of restarts, and the number of date changes.

#  acctcon1 -o overall_file < /var/adm/wtmp | more overall_file

from Thu Jan  13 17:20:12 1994 EDT
to   Fri Jan  14 09:56:42 1994 EDT
2   date changes
2   acctg off
0   run-level S
2   system boot
2   acctg on
1   acctcon1

The overall-record format includes the from and to fields, which specify the time that the last accounting report was generated and the time of the current report. These fields are followed by a list of records from the /var/adm/wtmp file.

12.4.6    The acctcon2 Command

The runacct shell script invokes the acctcon2 command to convert the /var/adm/acct/nite/ctmp connect session file, which is produced by the acctcon1 command, from ASCII format into binary format.

12.4.7    The prctmp Shell Script

The prctmp shell script writes column headings on a connect session database file that has the utmp.h header file structure, such as the /var/adm/acct/nite/ctmp file, which is created by the acctcon1 command. The prctmp shell script has the following syntax:

/usr/sbin/acct/prctmp [ filename ]

Refer to the prctmp(8) reference page for more information.

12.4.8    The lastlogin Shell Script

The lastlogin shell script writes the last date that a user logged in to the system to the /var/adm/acct/sum/loginlog file. The script invokes the printpw command to access the login names and user identification numbers in the /etc/passwd file.

The runacct shell script invokes the lastlogin shell script during its CMS state. You can invoke the lastlogin shell script manually to update the /var/adm/acct/sum/loginlog file, which is included in the /var/adm/acct/sum/rprtmmdd daily report.

The lastlogin shell script has the following syntax:

/usr/sbin/acct/lastlogin

12.4.9    The last Command

The last command displays, in reverse chronological order, all login records in the /var/adm/wtmp file. For each login session, the following information is provided:

• Time that the session began

• Duration of the session

• tty terminal on which the session took place

The following information is included when applicable:

• Terminations when rebooting

• Continuing sessions

The last command has the following syntax:

/usr/bin/last [ -# ] [ username ... ] [ tty ... ]

By default, all records are displayed. You can specify a user name and a terminal for which you want to display records.

The following example displays information only about the three previous root logins:

#  last -3 root

root    ttyp1     shout     Fri Jan 21 10:56   still logged in
root    ttyp1     raven     Fri Jan 21 08:59 - 09:00  (00:00)
root    ttyp0     raven     Thu Jan 20 15:29 - 15:54  (00:24)

12.5    Process Accounting

Process accounting occurs when a command, shell script, or program is executed in the system. When a process exits, the kernel writes the process accounting record to the /var/adm/pacct database file. Process accounting records enable you to monitor program execution statistics. You can use the ps command to get information about running processes. The accton command creates the /var/adm/pacct file and turns on process accounting.

The /var/adm/pacct file will grow in size. The ckpacct command checks the size of the /var/adm/pacct file and creates a /var/adm/pacctn file if the pacct file is larger than a specified size.

The /var/adm/pacct database file includes the following process information:

• Process type (for example, child process)

• Exit status indicating how the process terminated

• User identification number

• Group identification number

• Terminal from which the process originated

• Start, user, system, and CPU time

• Amount of memory used

• Number of I/O characters transferred

• Number of 1024-byte blocks read or written

• Name of the command used to start the process

The record format for the process accounting files is tacct format and is established by the acct header file structure. The acct header file structure is defined in the /usr/include/sys/acct.h header file and includes up to 18 columns of accounting information. The tacct structure members are defined in the private tacct.h header file.

Table 12-7 specifies the column number, heading, and description for files with the tacct format.

Table 12-7: The tacct File Format

Process accounting shell scripts and commands allow you to combine information about commands and the resources used to process the commands. The following sections describe the process accounting shell scripts and commands.

12.5.1    The accton Command

The accton command enables and disables process accounting. The accton command has the following syntax:

/usr/sbin/acct/accton [ filename ]

If you do not specify the filename variable, process accounting is disabled. If you specify the filename variable, process accounting is turned on and the kernel writes process accounting records to the specified file. Usually, this file is the /var/adm/pacct file; however, you can specify a different process accounting database file. The file must exist in the /var/adm directory, be owned by user adm, and be a member of the adm login group.

Note

The runacct and turnacct shell scripts use the /var/adm/pacct process accounting database file. If you specify a process accounting database file other than the /var/adm/pacct file, the runacct and turnacct shell scripts will be affected.

12.5.2    The turnacct Shell Script

The turnacct shell script controls the process accounting functions and creates process accounting files. You must be superuser to use the shell script. The turnacct script has the following syntax:

turnacct on | off | switch

The turnacct on shell script turns on process accounting by invoking the accton shell script with the /var/adm/pacct file argument.

The turnacct off shell script turns off process accounting by invoking the accton command without an argument to disable process accounting.

The turnacct switch shell script moves the contents of the /var/adm/pacct file to the /var/adm/pacctn file and then creates a new /var/adm/pacct file.

12.5.3    The ckpacct Shell Script

The /var/adm/pacct file can grow in size. If the /var/adm/pacct file is larger than a specified limit and if enough disk space is available, the ckpacct script invokes the turnacct switch shell script to move the contents of the /var/adm/pacct file to the /var/adm/pacctn file and create a new /var/adm/pacct file.

You can set up your cron daemon to invoke the ckpacct script periodically. Refer to Section 12.2.4 for more information.

The ckpacct shell script has the following syntax:

ckpacct [ blocksize ]

The blocksize variable specifies the size limit (in disk blocks) for the /var/adm/pacct file. The default size is 500 disk blocks.

If you invoke the ckpacct shell script, the script checks the number of disk blocks that are available in the /var/adm directory. If the number of available blocks is less than the size limit, process accounting is disabled by invoking the turnacct off shell script. A diagnostic message is displayed and mailed to the address that is specified with the MAILCOM environment variable. Use the putenv function to set the MAILCOM environment variable to the following command:

mail root adm

The following diagnostic message shows that there are 224 disk blocks remaining in the /var/adm directory:

ckpacct: /var/adm too low on space  (224 blocks)
  "turning acctg off"

The ckpacct shell script continues to display diagnostic messages until adequate space exists in the /var/adm directory.

12.5.4    The acctcom Command

The acctcom command displays summaries of process accounting records. Command options allow you to specify the type and format of the output. You do not have to be superuser to use the acctcom command.

The acctcom command displays information only about processes that have terminated; use the ps command to display information about active processes. The acctcom command has the following syntax:

/usr/bin/acctcom [ option... ] [ filename ... ]

If you do not specify the filename variable, the command uses the /var/adm/pacct file to obtain the process accounting records. You can use the filename variable to specify a different process accounting file that has the acct.h header file structure. If you specify more than one filename variable, the acctcom command reads the files in chronological order.

If you do not specify any command options, the default output includes the following information in a column heading format:

• Time and date that accounting was enabled

• Command name

• User name

• tty name

• Process start time

• Process end time

• Real seconds

• CPU seconds

• Mean memory size (in kilobytes)

Refer to the acctcom(8) reference page for information on the command options.

The following is an example of the default process accounting summary output:

#  /usr/bin/acctcom  /var/adm/pacct1

ACCOUNTING RECORDS FROM: Mon Jan 17 02:00:00 1994
COMMAND                  START    END        REAL   CPU    MEAN
NAME     USER   TTYNAME  TIME     TIME      (SECS) (SECS) SIZE(K)
#sa      root   ttyp1    11:59:00 11:59:00   0.77   0.01   0.00
ls       root   ttyp1    11:59:04 11:59:04   0.11   0.01   0.00
uugetty  root   ?        11:58:39 11:59:48  69.53   0.01   0.00
#ls      root   ttyp1    11:59:55 11:59:55   0.30   0.01   0.00
uugetty  root   ?        11:59:49 12:00:58  69.48   0.01   0.00
cp       adm    ?        12:05:01 12:05:01   0.33   0.01   0.00
chmod    adm    ?        12:05:01 12:05:01   0.27   0.01   0.00
#df      adm    ?        12:05:02 12:05:02   0.38   0.01   0.00
awk      adm    ?        12:05:02 12:05:02   0.58   0.01   0.00
sed      adm    ?        12:05:02 12:05:02   0.56   0.01   0.00

12.5.5    The sa Command

The sa command summarizes process accounting information. This command helps you to manage the large volume of accounting information. The files produced by the sa command include all the available process accounting information. The sa command has the following syntax:

/usr/sbin/sa [ options ... ] [ filename ]

The filename variable specifies a process accounting file with the acct.h header file structure. If the filename variable is not specified, the /var/adm/pacct file is used.

If you invoke the sa command with no options, the default output consists of six unheaded columns. Certain command options allow you to expand the six columns to include more information. You can specify options to change the format and to output additional information that includes an identifying suffix. Refer to the sa(8) reference page for information on the command options.

The following example shows the default format of the output of the sa command:

#  /usr/sbin/sa

798      277.24re       0.08cpu    3248790avio      0k
  7       33.42re       0.08cpu     103424avio      0k    csh
 14        0.08re       0.00cpu     127703avio      0k    mv
 40        0.34re       0.00cpu     159968avio      0k    cp
  2        0.01re       0.00cpu     132448avio      0k    acctwtmp
 34        0.13re       0.00cpu     133517avio      0k    chmod
 23        0.10re       0.00cpu     139136avio      0k    chgrp
 25        0.11re       0.00cpu     144768avio      0k    chown
 36        0.15re       0.00cpu     133945avio      0k    dspmsg
 32        0.18re       0.00cpu     134206avio      0k    cat
 [1]         [2]          [3]          [4]            [5]    [6]

1. Shows information about the number of command executions. An additional column is added to show the command percentage if you specify the -c option. [Return to example]

2. Shows information about the amount of real time used. An additional column is added to show the real-time percentage if you specify the -c option. [Return to example]

3. Shows information about CPU time used. Depending on the options specified, the column can show the total system and user CPU time, the user CPU time, the system CPU time, or the ratio of user CPU time to system CPU time. An additional column is added to show the real-time percentage if you specify the -c option. Also, an additional column is added to show the ratio of real time to total user and system CPU time if you specify the -t option. [Return to example]

4. Shows information about disk I/O operations, either the average number of I/O operations or the total number of I/O operations. [Return to example]

5. Shows information about kiloblocks (number of blocks multiplied by 1024) used or the memory time integral. [Return to example]

6. Shows the command name. [Return to example]

The following example adds three columns to the default format to display the following percentages:

#  /usr/sbin/sa -c

645 100.00% 324.10re 100.00% 0.02cpu 100.00% 6171050avio 0k
  2   0.31%  25.70re   7.93% 0.02cpu 100.00%  107392avio 0k csh
  6   0.93%   0.04re   0.01% 0.00cpu   0.00%  132928avio 0k mv
 38   5.89%   0.33re   0.10% 0.00cpu   0.00%  163357avio 0k cp
  2   0.31%   0.01re   0.00% 0.00cpu   0.00%  132992avio 0k cat
 26   4.03%   0.11re   0.03% 0.00cpu   0.00%  136832avio 0k chmod
 24   3.72%   0.10re   0.03% 0.00cpu   0.00%  139824avio 0k chgrp
      [1]        [2]          [3]

The additional columns show the following information:

1. Indicates the number of times each command was executed with respect to the total number of times all commands were executed. [Return to example]

2. Indicates the amount of real time needed to execute the command the number of times specified in column one with respect to the total real time required to execute all the commands. [Return to example]

3. Indicates the amount of CPU time needed to execute the command the number of times specified in column 1 with respect to the total CPU time required to execute all commands. [Return to example]

12.5.6    The acctcms Command

The acctcms command produces ASCII and binary total command summary files from process accounting records. You specify process accounting files that have the /usr/include/sys/acct.h header file structure, such as the /var/adm/pacct file. The acctcms command sorts the records and combines the statistics for each command used during the accounting period into a single record. The records allow you to identify the commands used most and the commands that use the most system time.

The runacct shell script invokes the acctcms command during its CMS state. You can also invoke this command manually to create a command summary report.

The acctcms command has the following syntax:

/usr/sbin/acct/acctcms [ -acjnopst ] filename ...

If you invoke the acctcms command with no options, the command sorts the output in descending order according to total kcore minutes, which is the number of kilobytes of memory used by the process multiplied by the buffer time used. Binary output is the default. Use the following calculation to obtain the kcore minutes:

kcoremin=[(CPU time in seconds)*(mean memory size in kbyte)]/60

Refer to the acctcms(8) reference page for information on the command options.

Note

If you use the acctcms command to produce a total summary file in ASCII format, each command record will consist of more than 80 characters, and the entire width of 8.5 x 11-inch paper could be used if the 10-character per inch constant-width font is specified. If part of a record exceeds the column width, it is moved to the next line.

The following example produces ASCII output that includes the statistics for commands that were invoked only once in a row specifying ***other in the COMMAND NAME column:

#  acctcms -a -j /var/adm/pacct1

                        TOTAL COMMAND SUMMARY
COMMAND NUMBER TOTAL  TOTAL  TOTAL   MEAN  MEAN   HOG    CHARS  BLOCKS
NAME    CMDS KCOREMIN CPUMIN REALMIN SIZEK CPUMIN FACTOR TRNSFD READ

 

TOTALS  9377  0.00    0.36  26632.67 0.00  0.00   0.00 17768213 100529

 

chmod     34  0.00    0.00       .15 0.00  0.00   0.07  5785856    64
ln         4  0.00    0.00      0.01 0.00  0.00   0.78   422016    16
xterm      9  0.00    0.03    537.41 0.00  0.00   0.00 22948288   536
getcons    8  0.00    0.00      0.14 0.00  0.00   0.07 26636992   102
cfe2.20    4  0.00    0.00      0.09 0.00  0.00   0.12   182464   155
dump      22  0.00    0.00     14.91 0.00  0.00   0.00 69402112   128
whoami     4  0.00    0.00      0.03 0.00  0.00   0.36  7405952    27
restore   40  0.00    0.00     49.16 0.00  0.00   0.00 34247488  1316
***other  25  0.00    0.00   3546.88 0.00  0.00   0.00 35904984   737
hostname   2  0.00    0.00      0.01 0.00  0.01   0.94   223104    14

The hog factor is the total CPU time divided by the total real time.

12.5.7    The acctprc1 Command

The acctprc1 command reads process accounting records from files with the /usr/include/sys/acct.h header file structure, adds the login names that correspond to the user identification numbers, and displays the records in ASCII format. Login session records are sorted according to user identification number and login name.

If your system has users with the same user identification number, you should use a process accounting file in the /var/adm/acct/nite directory instead of the /var/adm/pacct file.

The runacct shell script invokes the acctprc1 command during its PROCESS state. You can also invoke the command manually. The acctprc1 command has the following syntax:

/usr/sbin/acct/acctprc1 [ filename ]

The filename variable specifies a file that contains a list of login sessions in a format defined by the /usr/include/utmp.h header file structure. If the filename variable is not specified, login names are obtained from the /etc/passwd file.

The command output specifies information in a format with seven unheaded columns that specify the following:

• User identification number

• Login name

• Number of CPU seconds the process used during prime time

• Number of CPU seconds the process used during nonprime time

• Total number of characters transferred

• Total number of blocks read from and written to

• Mean memory size (in kilobytes)

The following is an example of the acctprc1 command and its output:

#  /usr/sbin/acct/acctprc1  < /usr/adm/pacct

   0   root      0     1   17228   172    6
   4   adm       0     6   46782    46   16
   0   root      0    22  123941   132   28
9261   hoffmann  6     0   17223    22   20
   9   lp        2     0   20345    27   11
9261   hoffmann  0   554   16554    20  234

12.5.8    The acctprc2 Command

The acctprc2 command reads records produced by the acctprc1 command, summarizes them according to user identification number and login name, and then uses the tacct file format to display the sorted summaries as total accounting binary records. You can merge the binary file produced by the acctprc2 command with other total accounting files by using the acctmerg command to produce a daily summary accounting record file.

The runacct shell script invokes the acctprc2 command during its PROCESS state. You can also invoke the command manually.

12.5.9    The lastcomm Command

The lastcomm command displays command execution information from the /var/adm/pacct file in reverse chronological order.

The following information is displayed for each process:

• Command name

• Either the S flag, which specifies that the command was invoked by the superuser; or the F flag, which specifies that the command ran after a fork but was not followed by an exec system call

• Name of the user who issued the command

• Terminal from which the command was started

• Number of seconds of CPU time used

• Time the process started

The lastcomm command has the following syntax:

/usr/bin/lastcomm [ command ] [ username ] [ tty ]

The following example displays information about the sed commands executed by root:

#  lastcomm sed root

sed      S  root     ttyp0      0.01 secs Fri Jan 21 11:34
sed      S  root     ttyp0      0.01 secs Fri Jan 21 11:34

12.6    Disk Usage Accounting

Disk usage accounting is performed by the dodisk shell script. The dodisk shell script uses either the diskusg or the acctdusg command to write information to the intermediate ASCII file /var/adm/dtmp. The shell script then uses the intermediate file as input to the acctdisk command to create a binary total accounting database file, /var/adm/acct/nite/dacct. The dodisk script performs disk accounting on all or selected file systems specified in the /etc/fstab file system database file.

You can combine the total accounting information in the /var/adm/acct/nite/dacct file with other accounting information to create complete accounting reports. For example:

#  /usr/sbin/acct/dodisk
#  /usr/sbin/acct/prtacct /var/adm/acct/nite/dacct

12.6.1    The dodisk Shell Script

Use the dodisk shell script to obtain disk usage accounting. You can set up your cron daemon to run the dodisk script automatically, or you can invoke the command manually. The dodisk shell script has the following syntax:

/usr/sbin/acct/dodisk [ -o ] [ filesystem ... ]

/usr/sbin/acct/dodisk [ device special file... ]

Using the -o option, you can specify the file system variable to perform disk usage accounting on the mount point of a UFS file system or an AdvFS fileset. If the -o option is not specified, the variable must be the raw or character device special file. For example:

#  /usr/sbin/acct/dodisk /dev/rrz3c

If you do not specify any arguments, disk accounting is performed on the UFS device special files decribed in the /etc/fstab database file. Refer to the fstab(4) reference page for more information.

Note

If you have a swap space specified in the /etc/fstab file, the dodisk shell script will not execute correctly. In this case, you can edit the dodisk shell script to use only specific file systems or you can invoke the dodisk shell script and specify the file systems for which you want accounting.

If you specify the -o option, the dodisk shell script uses the acctdusg command instead of the diskusg command to perform a more thorough but slower version of disk accounting. If you specify the -o option and a filesystem variable, specify the mount point instead of the device special file name.

12.6.2    The diskusg Command

The diskusg command displays disk accounting records. The diskusg command obtains user login names and identification numbers from the /etc/passwd file. The diskusg command has the following syntax:

/usr/sbin/acct/diskusg [ -options ] filesystems

Refer to the diskusg(8) reference page for information on the command options.

The diskusg command produces ASCII output, which is directed to the /var/adm/dtmp file. This file is used as input to the acctdisk command, which converts the ASCII records to binary total accounting records in the /var/adm/acct/nite/dacct file. You can merge these records with other accounting records to create a daily total accounting report.

Each output record produced by the diskusg command contains the user identification number, login name, and the total number of disk blocks allocated to the user. Because the diskusg command checks user inode records, all disk space is accounted for, including empty directories.

The following is an example of the diskusg command:

#  /usr/bin/acct/diskusg  /dev/rrz3c

   0   root        63652
   1   daemon         84
   2   bin         71144
   4   adm           976
   5   uucp         3324
 322   homer           2
 521   whistler        2
 943   cellini       363
1016   pollock        92
1098   hopper        317

12.6.3    The acctdusg Command

The acctdusg command performs more thorough disk accounting than the diskusg command. If dodisk is invoked with the -o option, the acctdusg command is used to create the /var/adm/dtmp file.

The acctdusg command has the following syntax:

acctdusg [ -u filename ] [ -p filename ]

Refer to the acctdusg(8) reference page for information on the command options.

You must direct a binary disk usage file, usually /var/adm/dtmp, to the command. If the dodisk shell script invokes the command, the acctdusg command uses the file systems specified with the dodisk script as input.

The input to the acctdusg command is usually a list of files piped from a find / -print command. The command compares the file pathnames to the users' login directories ($HOME). If a file pathname is the same as a user's login directory, that user is charged for the file. Therefore, the directory in which the file is located is the determining factor in charging users for disk space. You can use the -u option to display the number of disk blocks used by files in directories other than the login directories.

For each file, the acctdusg command calculates the computed value, which is the number of disk blocks (including hidden or indirect blocks) that are allocated to the file divided by the number of hard links. If two or more users have links to the same file, the acctdusg command charges each user an equal percentage of the file's total disk space.

The acctdusg command output displays the user identification number, the user name, and the sum of the computed values of all the files owned by the user in three columns and adds leading 0s (zeros) to the user identification number. The acctdusg command does not display the disk-block count for empty directories.

12.6.4    The acctdisk Command

The acctdisk command creates a binary total accounting file. If it is invoked from the dodisk script, the acctdisk command reads the /var/adm/dtmp file that is produced by either the diskusg or acctdusg command. It then writes converted binary records to a temporary file, which is then moved to the /var/adm/acct/nite/dacct file.

The disk usage accounting records produced by the acctdisk command are usually merged with other accounting records to produce a total accounting report.

12.7    System Administration Service Accounting

You can charge users for system administration services. For example, you could charge for the following services:

• Backing up files to disk

• Recovering files from disk

• Backing up files to tape

• Recovering files from tape

• Providing software technical assistance by phone

• Providing software technical assistance in person

The chargefee shell script allows you to charge users according to the work performed. You should determine how much you want to charge for each service. Services can have different charge rates according to the time it takes to perform the task.

Charge units are collected in the /var/adm/fee file. You can use the number of units charged to a user name to determine the fees for the system administration tasks. The chargefee shell script creates the /var/adm/fee file, if necessary, and adds a record that includes the user identification number, user name, and charge units.

The chargefee shell script has the following syntax:

/usr/sbin/acct/chargefee user_name units

You can subtract units by specifying a dash (-) with the units variable.

The following example charges 7 units to user josh:

#  chargefee josh 7

If the previous command is issued, the following record is written to the /var/adm/fee file:

1114 josh 0 0 0 0 0 0 0 0 0 0 0 0 7 0 0 0

12.8    Printer Accounting

When you use a printer that has accounting enabled, a record is written to the printer accounting file. Printer accounting records have a specific syntax and provide the following information:

• Name of the host and user that issued the print request

• Number of pages or feet of medium printed

• Number of times the printer was used

• Price per unit of printed output

The printer accounting records enable you to charge users for the system printing resources and to track printer usage.

The two printer accounting files are located in either the /var/adm or the /var/adm/printer directory. The printer.acct printer user file lists the amount and cost of print media used, according to machine and user name. The printer.acct_sum printer summary file lists a summary of media produced according to machine and user name. The printer variable specifies the printer name. Refer to Chapter 10 for information on creating the printer accounting files.

Use the pac command to create a report of your printer activity. The pac command can obtain information only for printers that have accounting enabled. The pac command has the following syntax:

pac [ -cmrs ] [ -p price ] [ -P printer ] [ user... ]

Refer to the pac(8) reference page for information on the command options.

12.9    Creating Daily, Summary, and Monthly Report Files

There are four shell scripts and one command that you can use to create daily, summary, and monthly report files in the /var/adm/acct/nite, /var/adm/acct/sum, and /var/adm/acct/fiscal directories, as shown in the following table:

Command	Description
runacct	This shell script creates the daily and summary files in the /var/adm/acct/nite and /var/adm/acct/sum directories.
acctmerg	This command merges total accounting record files and allows you to combine process connect time, fee, disk usage, and print queue accounting records into files whose format you specify. The output can be in either the default binary format or ASCII format and can include up to 18 columns of accounting information.
prtacct	This shell script formats and displays accounting files that have the /usr/include/sys/acct.h header file structure. Each record includes information about the user identification number, connect time, process time, disk usage, and printer usage.
prdaily	This shell script creates an ASCII file that contains the accounting data from the previous day. When this script is invoked from the runacct script, it creates the /var/adm/acct/sum/rprtmmdd file.
monacct	This shell script creates cumulative process and total accounting files in the /var/adm/acct/fiscal directory.

The following sections describe the shell scripts and the command in detail.

12.9.1    The runacct Shell Script

The runacct shell script uses accounting shell scripts and commands to process the connect time, fee, disk usage, queue, and process accounting database files to create the daily and summary files in the /var/adm/acct/nite and /var/adm/acct/sum directories.

The /var/adm/acct/nite directory contains files that are reused daily by the runacct script. Some of these files have binary counterparts in the /var/adm/acct/sum directory, which contains the cumulative summary files that are updated by the runacct shell script and used by the monacct shell script to produce monthly reports.

You can set up the cron daemon to invoke the runacct shell script each day, or you can invoke the runacct shell script manually. You may have to invoke the command manually if the runacct shell script does not complete or if a file created by the script becomes corrupted or lost.

Note

When you invoke the runacct shell script it creates the /var/adm/acct/nite/lock temporary file. If the /var/adm/acct/nite/lock file exists, the runacct shell script will not run.

The runacct shell script executes in the following 13 states, in the order listed, and can be restarted at any of the 13 states:

State	Description
SETUP	Sets up some of the accounting files.
WTMPFIX	Fixes corrupted date and time stamp entries that can cause commands such as the acctcon1 command to fail.
CONNECT1	Writes connect session records.
CONNECT2	Uses the connect session records to create a binary total accounting record that will be merged with other records to create a daily report.
PROCESS	Produces process accounting report files.
MERGE	Uses the acctmerg command to create the binary total accounting file.
FEES	Uses the acctmerg command to merge records from the /var/adm/fee file into the binary total accounting file.
DISK	Uses the acctmerg command to merge disk-usage records into the binary total accounting file.
QUEUEACCT	Uses the acctmerg command to merge print queue accounting records into the binary total accounting file.
MERGEACCT	Copies the binary total accounting file to the daily total accounting file, which is used as input to the acctmerg command to create the cumulative total daily accounting file.
CMS	Produces command usage summaries.
USEREXIT	Invokes any site-specific shell scripts.
CLEANUP	Removes the temporary files.

12.9.1.1    Correcting runacct Shell Script Errors

If a runacct shell script error occurs, a message is written to the console device, the lock file is removed, the diagnostic files and error messages are saved, and processing is halted. Use the following information to determine if a runacct shell script error has occurred:

• The /var/adm/acct/nite/active file is created if the script has successfully completed. The runacct shell script logs messages to this file. You can use this file to determine which tasks have been successfully completed. The following is an example of an active file:

  Fri Feb 4 11:02:56 EST 1994
  -rw-r--r-- 1 adm  adm      0 Jan 31 03:00 /var/adm/acct/nite/dacct
  -rw-rw-r-- 1 root system 924 Jan 05 10:45 /var/adm/wtmp
  -rw-rw-r-- 1 adm  adm      0 Jan 08 13:46 fee
  -rw-rw-r-- 1 adm  adm      0 Jan 07 02:00 pacct
  -rw-rw-r-- 1 adm  adm   8904 Jan 02 11:02 pacct1
  files setups complete
  wtmp processing complete
  connect acctg complete
  process acctg complete for /var/adm/Spacct1.1101
  process acctg complete for /var/adm/Spacct2.1101
  all process acctg complete for 1101
  tacct merge to create daytacct complete
  no fees
  no disk records
  no queueing system records
  updated sum/tacct
  command summaries complete
  system accounting completed at Fri
  

• The /var/adm/acct/nite/activemmdd file is created if the script has not successfully completed. This file contains information about the script execution; you can use it to determine where the script failed.

• The /var/adm/acct/nite/statefile file contains the name of the last state that the runacct shell script executed. Note that the runacct shell script may not have successfully completed this state.

• The /var/adm/acct/nite/lastdate file contains the date of the last runacct shell script execution. If the date specified in the file is the current date, the shell script will not run.

If the runacct shell script fails or terminates before it is completed, you must restart the script from its last successfully completed state. The /var/adm/acct/nite/statefile file contains the name of the state that was last executed.

The runacct shell script has the following syntax:

/usr/sbin/acct/runacct [ mmdd ] [ state ]

The mmdd variable specifies the date for which you want to run the runacct shell script. Use the state variable to specify the state from which you want the runacct script to start processing.

If the runacct shell script fails on more than one successive day, invoke the SETUP state commands manually.

Note

Before you restart the runacct shell script, you should remove the /var/adm/acct/nite/lock file and the /var/adm/acct/nite/lastdate file.

In the following example, the runacct shell script is invoked at its MERGE state and uses the accounting database files from January 26:

#  runacct 0126 MERGE > /var/adm/nite/fd2log&

The following example invokes the runacct shell script, which uses the accounting database files from January 26 and specifies the nohup command so that signals, hangups, logouts, and quits are disregarded; any error messages generated during its execution are written to the fd2log file:

#  nohup runacct 0126 > /var/adm/acct/nite/fd2log& 

12.9.1.2    Examples of Errors and Corrective Actions

The following list provides examples of errors and the actions you can take to correct problems:

ERROR: locks found. run aborted

A /var/adm/acct/nite/lock file exists. Remove the file and restart the runacct shell script from its last completed state.

ERROR: acctg already run for Fri : check Jan

The current date is the same as the date specified in the /var/adm/acct/nite/lastdate file. Remove the file and restart the runacct shell script from its last completed state.

ERROR: runacct called with invalid arguments

You have specified invalid arguments with the runacct shell script.

ERROR: turnacct switch returned rc=?

The accton command failed when it was invoked by the turnacct switch shell script. Check the accton command protections and ensure that user adm can invoke the command.

ERROR: Spacct?.mmdd already exists run setup manually

You must invoke the runacct shell script manually from the MERGE state.

ERROR: wtmpfix errors see nite/wtmperror

An unrepairable wtmp file was found during the WTMPFIX state. Use the fwtmp command to correct the file.

ERROR: invalid state, check /usr/var/adm/nite/active

During processing, the runacct shell script may have detected a corrupted active file. Check the /var/adm/acct/nite/active* and statefile files.

12.9.2    The acctmerg Command

The acctmerg command combines process, connect time, fee, disk-usage, and queue total accounting record files with the tacct file format. For example, you can merge the total accounting records for a particular login name and user identification number to provide a single group of records for that login name and user identification number. File records are usually merged according to the user identification number or the user login name.

The default command output is in binary format, but you can also produce ASCII output. The default acctmerg command output has the /usr/include/sys/acct.h header file structure and includes up to 18 columns of accounting information. Records with the /usr/include/sys/acct.h header file structure that include data types specified as an array of two double elements can have both prime time and nonprime time values.

The runacct shell script invokes the acctmerg command. You can also invoke the command manually to produce reports. The acctmerg command has the following syntax:

/usr/sbin/acct/acctmerg [ -ahiptuv ] [ # ] [ file... ]

You can specify up to nine total accounting record files. If you do not specify a file, records are read from standard input.

Refer to the acctmerg(8) reference page for information on command options.

The following example reads the UID, LOGNAME, DSK_BLOCKS, and DSAMPS column entries from the /var/adm/acct/nite/dacct ASCII disk accounting file. It then merges them into binary records in the /var/adm/acct/sum/tacct total accounting file.

#  acctmerg  -i1-2,13,18 < nite/dacct | sum/tacct 

You can use the acctmerg command to correct errors in the /var/adm/sum/tacct file. Errors that can occur in the file include negative numbers and duplicate user identification numbers.

To correct errors in the current /var/adm/sum/tacct file:

1. Change your directory to /var/adm/sum.

2. Enter the prtacct command to display the /var/adm/sum/tacctprev file. If the file is correct, then the problem probably is located in the /var/adm/sum/tacctmmdd file. This example assumes that the /var/adm/sum/tacctmmdd file needs to be fixed.

3. To obtain an ASCII version of the /var/adm/sum/tacctmmdd file, enter:

   #  acctmerg -v < tacct.0617 > tacct_temp
   

4. Edit the temporary file and correct the records as necessary.

5. To re-create the /var/adm/sum/tacctmmdd file, enter:

   #  acctmerg -i < tacct_temp > tacct.0617
   

6. To re-create the /var/adm/sum/tacct file, enter:

   #  acctmerg tacctprev < tacct.0617 > tacct
   

12.9.3    The prtacct Shell Script

The prtacct shell script displays a binary total accounting file with the tacct file format in ASCII format. The script allows you to produce a connect time, process time, disk usage, or printer usage report file.

The monacct and prdaily shell scripts invoke the prtacct shell script. The runacct shell script invokes the prdaily shell script during its CLEANUP state. The prtacct shell script has the following syntax:

/usr/sbin/acct/prtacct [ -f column ] [ -v ] file

Refer to the prtacct(8) reference page for information on the command options.

12.9.4    The prdaily Shell Script

The prdaily shell script creates an ASCII report of the accounting data from the previous day. The runacct shell script invokes the prdaily shell script during its CLEANUP state to create the /var/adm/acct/sum/rprtmmdd file. You can invoke the command manually to produce a report.

The prdaily script combines information from the following six accounting files:

• /var/adm/acct/nite/reboots

• /var/adm/acct/nite/lineuse

• /var/adm/acct/sum/tacctmmdd

• /var/adm/acct/nite/daycms

• /var/adm/acct/nite/cms

• /var/adm/acct/sum/loginlog

The prdaily shell script has the following syntax:

prdaily [ -l ] | [ -c ] [ mmdd ]

Refer to prdaily(8) for more information on command options.

12.9.5    The monacct Shell Script

The monacct shell script uses the binary accounting files to create cumulative summary files in the /var/adm/acct/fiscal directory. After the summary files are produced, the command removes the old accounting files from the /var/adm/acct/sum directory and creates new files.

Usually, you run the monacct script once each month to produce monthly report files. You can set up your cron daemon to run the shell script automatically. Refer to Section 12.2.4 for more information. The monacct shell script has the following syntax:

/usr/sbin/acct/monacct [ number ]

The number variable specifies an integer that is within the range 1 to 12 and that specifies the month for which you want to create the summary report. The default is the current month.

The monacct shell script creates the following files in the /var/adm/acct/fiscal directory:

tacctmm

Specifies the binary total accounting file for the month preceding the month specified by the mm variable.

cmsmm

Specifies the binary cumulative command summary file for the month preceding the month specified by the mm variable.

fiscrptmm

Specifies the ASCII total monthly accounting report file. This file has a format that is similar to the /var/adm/acct/sum/rprtmmdd report file and is created from the following files:

• /var/adm/acct/fiscal/tacctmm

• /var/adm/acct/fiscal/cmsmm

• /var/adm/acct/sum/loginlog