10/03/95 Setup of System Accounting in AIX 3.2 SPECIAL NOTICES Information in this document is correct to the best of our knowledge at the time of this writing. Please send feedback by fax to "AIXServ Information" at (512) 823-5972. Please use this information with care. IBM will not be responsible for damages of any kind resulting from its use. The use of this information is the sole responsibility of the customer and depends on the customer's ability to eval- uate and integrate this information into the customer's operational environment. +----------------------------------------------------------+ | | | NOTE: The information in this document has NOT been | | verified for AIX 4.1. | | | +----------------------------------------------------------+ ABOUT THIS DOCUMENT The setup of system accounting as documented in the 3.2 AIX InfoExplorer has some errors. This document describes the Version 3.2 setup procedures and provides the corrections to enable system accounting under AIX version 3.2. The InfoExplorer and system documentation for AIX Version 3.2 require the setup person to be root. In this document, we will use the "root" user for setting up system accounting and the user "adm" for running the reports. You may want to modify the root user ".profile" in order to provide access to the required executables. The modifica- tion of the root profile is optional, but will probably help with administration. The following sections are included in this document: "Steps for Modifying the Root User Profile" "Steps for Setting Up System Accounting" "Fields of the Daily Usage Report" "Fixes" "Diagnosing Problems" STEPS FOR MODIFYING THE ROOT USER PROFILE 1. Log in as root. 2. Edit the ".profile" file with your favorite text editor. 3. Locate the PATH statement in the .profile file. It must include the /usr/sbin/acct and /var/adm/acct directo- ries. The following (entered all as one line) works correctly for this purpose. Setup of System Accounting in AIX 3.2 1 10/03/95 PATH= /usr/bin:/etc:/usr/sbin:/usr/ucb:/usr/bin/X11:/sbin: /usr/sbin/acct:/var/adm/acct ; export PATH 4. Locate the export statement in the /.profile. It must include the PATH variable if you did not enter the PATH statement given above. STEPS FOR SETTING UP SYSTEM ACCOUNTING 1. Log in to the system as the root user. As described previously, root is the accounting administrator. 2. Execute the command: su - adm -c /usr/lib/acct/nulladm /var/adm/wtmp /var/adm/pacct This command ensures correct permissions and provides access to the wtmp and pacct files. 3. Update the /etc/acct/holidays file for the current year using your favorite text editor. The following notes will help in understanding the format of this file: o An asterisk (*) in column 1 denotes a comment. o Define prime time on the first data line (the first line that is not a comment) using a 24-hour clock. The line will consist of three 4-digit fields, in the following order: - current year - When (hhmm) prime time begins - When (hhmm) prime time ends Leading blanks are ignored. You can enter midnight as either 0000 or 2400. For example, to specify the year 1992 with prime time beginning at 8:00 a.m. and ending at 5:00 p.m., specify: 1992 0800 1700 o Define the company holidays for the year on the next data line. Each line contains four fields in the following order: - Day of the year - Month - Day of the month - Description of the holiday o The day-of-the-year field contains the number of the day of the year in which the holiday falls. It must be a number from 1 thru 365 (366 on a leap year like 1992). 4. Turn on process accounting by adding the following line to the /etc/rc file. Setup of System Accounting in AIX 3.2 2 10/03/95 /usr/bin/su - root -c /usr/sbin/acct/startup The startup command records the time that accounting was turned on and cleans up the previous days accounting files. 5. The file systems that will be included for accounting information need to be configured in the "/etc/filesystems" file. For each file system that will be included, add the following information to its stanza: account = true 6. Indicate the data file that will be used for printer data by adding the following line to the /etc/qconfig stanza for that printer: acctfile = /var/adm/qacct NOTE: The printer accounting will not record usage for network printers, transparent printers, or PostScript printers. In addition, all print queues must use the same accounting file: /var/adm/qacct The pac command (printer accounting command) is more versatile because it allows separate accounting files for each printer. For more information, see InfoExplorer. 7. Create directories "/var/adm/acct/nite", "/var/adm/acct/fiscal", and "/var/adm/acct/sum" if they do not already exist. These directories should be owned by "adm" with a group ID of "adm". Use the following commands to create these directories: su - adm cd /var/adm/acct mkdir nite fiscal sum chown adm:adm nite fiscal sum chmod 755 nite fiscal sum exit 8. Modify the crontabs file for the "adm" user for auto- mated accumulation of accounting data. The crontabs file for the "adm" user is in /var/spool/cron/crontabs/adm To edit the adm crontab, log on as the "root" and execute: su - adm -c crontab -e This will bring up the adm crontab in a vi session. Setup of System Accounting in AIX 3.2 3 10/03/95 You may need to uncomment or add some entries as well as modify times to suit your installation's time require- ments. An example of the entries needed follows: 10 23 * * 0-6 /usr/lib/acct/runacct 2>/usr/adm/acct/nite/accterr > /dev/null 0 23 * * 0-6 /usr/lib/acct/dodisk > /dev/null 2>&1 0 * * * * /usr/lib/acct/ckpacct > /dev/null 2>&1 15 4 1 * * /usr/lib/acct/monacct > /dev/null 2>&1 The first line starts runacct at 11:10 pm (10 23), each Sunday through Saturday (0-6). runacct runs the daily reporting. The second line starts disk accounting at 11:00 pm (0 23), each Sunday through Saturday (0-6), before starting runacct. The third line checks the /var/adm/pacct file to ensure that it does not get too large at 0 minutes past each hour (0 *) every day (*). The fourth line runs the monthly accounting reports at 4:15 am on the first of every month. FIELDS OF THE DAILY USAGE REPORT The meaning of the fields in the accounting Daily Usage Report are as follows: | UID User ID number. | LOGIN NAME Login name of user. | CPU PRIME Cumulative CPU minutes during prime hours. | CPU NPRIME Dring non-prime hours. | KCORE PRIME Cumulative minutes spent in the kernel during | prime hours. | KCORE NPRIME Dring non-prime hours. | BLKIO PRIME Cumulative blocks transferred during prime | hours. | BLKIO NPRIME Dring non-prime hours. | RW/WR PRIME Cumulative blocks read/written during prime | hours. | RW/WR NPRIME During non-prime hours. | CONNECT PRIME Cumulative connect time (minutes) during prime | hours. | CONNECT NPRIME During non-prime hours. | DISK BLOCKS Cumulative disk usage. Setup of System Accounting in AIX 3.2 4 10/03/95 | PRINT Queuing system charges (pages). | FEES Fee for special services. | # OF PROCS Count of processes. | # OF SESS Count of login sessions. | # OF SAMPLES Count of count of disk samples. FIXES Fixes (PTFs) for AIX 3.2.5 and later can be downloaded via Internet with the FixDist service. For FixDist information and instructions, order fax number 1228 from 1-800-IBM-4FAX. If you don't have access to Internet or if your machine is at a pre-3.2.5 AIX level, you can request a specific fix number from 1-800-CALL-AIX. All other services from 1-800-CALL-AIX which are not Program Services require a software support contract. o The ac command shows tty#s instead of user names; this is APAR IX33592. o IX21777 will correct the problem with duplicate entries in the daily reports. This changes the sort routine to properly sort the file in acctmerge. o IX36593 fixes the problem of acctmerge shifting the rel- ative position of data when it converts records from binary to ASCII and back to binary. On Very Large Systems o On a very large system, the wtmp file will grow large enough to cause acctcon1 or acctcon2 to fail with a core dump. PTF U406493 fixes this. o On large systems, if there are over 1000 users in the /etc/passwd file, the /usr/sbin/acct/dodisk script must be changed. At line 136 in dodisk, the diskusg command must be changed to read: diskusg -Unnnnn $args > dtmp where nnnnn is the new maximum number of users for which disk accounting should be done. (When the maximum number is too small, the dodisk script will return an error message that tells the user to use -uxxxx. It should say -Uxxxx.) o IX32909 will correct the runacct program to allow more than 9 pacct files to exist. This caused a core dump. o IX31831 will correct the core dumping from acctproc1 on large systems. o IX32909 and IX31831 also correct the problem of negative numbers on the daily report. Setup of System Accounting in AIX 3.2 5 10/03/95 ACCTCOM o IX25313 corrects the problem of the CPU Real time being greater than the Elapsed time. On AIX 3.2.5 and Greater o IX38748 will correct the problem of a user missing the output from individual users for the CPU and DASD output. o IX39408 will correct the problem of process accounting failing on diskless workstations. o IX42292 will correct the problem of the runacct account command truncating the wtmp file during its nightly run, causing connection accounting to be lost for users who do not log off. o IX40232 will fix the problem of daily and monthly per- user memory accounting being off by a factor of exactly 200. o IX42322 will fix the problem of a 64 MB limit on system process accounting. With this problem, any process that used more than 64 MB of memory caused an overflow, and the process size reported by the ac_mem field was inac- curate. o IX43161 will fix the problem of acctprc2 core dumping with more than 500 users. o IX41228 will fix the problem of acctdisk entering an infinite loop if the input file is corrupted. o IX40305 will fix the problem of the /var/adm/acct/sum/loginlog file not being updated in 3.2.5. DIAGNOSING PROBLEMS General Information Needed o Which accounting command is being used? a. acctcms e. acctmerg b. acctcom f. acctprc c. acctcon g. acctprc1 d. acctdisk h. acctprc2 o All of the accounting commands listed above accept input from standard input (i.e. acctcms < /usr/adm/pacct) and redirect to standard output (i.e. acctcmd < /usr/adm/pacct > /tmp/report). Find out which accounting file is being used as standard input and where the output is being directed. Defaults are standard in and standard out. acct_cmd < In_file > Out_file Setup of System Accounting in AIX 3.2 6 10/03/95 o Note all command flags used. Exact syntax is very important. o How is accounting started? via cron or via command line? o If accounting is started via cron, note the crontab file entries. These entries will be found in one of two places. If accounting is run from "root" then the file will be in /usr/spool/cron/crontabs/root. If accounting is run from adm then the file will be in /usr/spool/cron/crontabs/adm. When Accounting Fails 1. Check to see what state accounting is in. Look at the /usr/adm/acct/nite/active file. States are: setup wtmpfix connect1 connect2 process merge fees disk queueacct mergetacct cms userexit cleanup 2. Check accterr for additional messages. 3. Based on error messages, fix the files by using the guidelines in the section "fixing damaged files" in InfoExplorer. 4. Restart runaccount. Other Things to Check o Is /usr is out of space? o Does wtmp have records with inconsistent data stamps? o Is cron failing (check mail for root and adm)? Setup of System Accounting in AIX 3.2 7 10/03/95 READER'S COMMENTS Please fax this form to (512) 823-5972, attention "AIXServ Informa- tion". Use this form to tell us what you think about this document. If you have found errors in it, or if you want to express your opinion about it (such as organization, subject matter, appearance) or make sug- gestions for improvement, this is the form to use. If you need technical assistance, contact your local branch office, point of sale, or 1-800-CALL-AIX (for information about support offer- ings). These services may be billable. Faxes on a variety of sub- jects may be ordered free of charge from 1-800-IBM-4FAX (415-855-4329 outside U.S., from fax machine phone). When you send comments to IBM, you grant IBM a nonexclusive right to use or distribute your comments in any way it believes appropriate without incurring any obligation to you. NOTE: If you have a problem report or item number, supplying that number may help us determine why a procedure did or did not work in your specific situation. Problem Report or Item #: Branch Office or Customer #: Be sure to print your name and fax number below if you would like a reply: Name: Fax Number: ______________________________________________________________________ ______________________________________________________________________ ______________________________________________________________________ ______________________________________________________________________ ______________________________________________________________________ ______________________________________________________________________ ______________________________________________________________________ ______________________________________________________________________ ______________________________________________________________________ ______________________________________________________________________ ______________________________________________________________________ ______________________________________________________________________ ______________________________________________________________________ END OF DOCUMENT (acct.setup.32.cmd, 4FAX# 2486) Setup of System Accounting in AIX 3.2 8