12/12/96, 4FAX #6832 Setup Of System Accounting In AIX 4.1 & 4.2 SPECIAL NOTICES Information in this document is correct to the best of our knowledge at the time of this writing. Please send feedback by fax to "AIXServ Information" at (512) 823-4009. Please use this information with care. IBM will not be responsible for damages of any kind resulting from its use. The use of this information is the sole responsibility of the customer and depends on the customer's ability to eval- uate and integrate this information into the customer's operational environment. ABOUT THIS DOCUMENT This document describes the AIX Version 4.1 and 4.2 accounting setup procedures. The InfoExplorer and system documentation for AIX Version 4.1 & 4.2 require the setup person to be root. In this doc- ument, we will use the "root" user for setting up system accounting and the user "adm" for running the reports. You may want to modify the root user ".profile" in order to provide access to the required executables. The modifica- tion of the root profile is optional, but will probably help with administration. The following sections are included in this document: What To Install To Get Accounting To Work On Your System 1 Steps For Modifying The Root User Profile . . . . . . . 1 Steps For Setting Up System Accounting . . . . . . . . 2 Fields Of The Daily Usage Report . . . . . . . . . . . 4 Fixes / Problems . . . . . . . . . . . . . . . . . . . 5 Diagnosing Problems . . . . . . . . . . . . . . . . . . 5 Reader's Comments . . . . . . . . . . . . . . . . . . . 7 WHAT TO INSTALL TO GET ACCOUNTING TO WORK ON YOUR SYSTEM You should have the following fileset installed - bos.acct - "lslpp -l bos.acct" should report committed or applied. To get the latest level software for the bos.acct fileset refer to the section on "Fixes" later in this document. STEPS FOR MODIFYING THE ROOT USER PROFILE 1. Log in as root. 2. Edit the ".profile" file with your favorite text editor. 3. Locate the PATH statement in the .profile file. It must include the /usr/sbin/acct and /var/adm/acct directo- ries. The following (entered all as one line) works correctly for this purpose. Setup Of System Accounting In AIX 4.1 1 4.2 1 12/12/96, 4FAX #6832 PATH= /usr/bin:/etc:/usr/sbin:/usr/ucb:/usr/bin/X11:/sbin: /usr/sbin/acct:/var/adm/acct ; export PATH 4. Locate the export statement in the /.profile. It must include the PATH variable if you did not enter the PATH statement given above. STEPS FOR SETTING UP SYSTEM ACCOUNTING 1. Log in to the system as the root user. As described previously, root is the accounting administrator. 2. Execute the command: su - adm -c /usr/lib/acct/nulladm /var/adm/wtmp /var/adm/pacct This command ensures correct permissions and provides access to the wtmp and pacct files. 3. Update the /etc/acct/holidays file for the current year using your favorite text editor. The following notes will help in understanding the format of this file. o An asterisk (*) in column 1 denotes a comment. o Define prime time on the first data line (the first line that is not a comment) using a 24-hour clock. The line will consist of three 4-digit fields, in the following order: current year When (hhmm) prime time begins When (hhmm) prime time ends Leading blanks are ignored. You can enter midnight as either 0000 or 2400. For example, to specify the year 1992 with prime time beginning at 8:00 a.m. and ending at 5:00 p.m., specify: 1992 0800 1700 o Define the company holidays for the year on the next data line. Each line contains four fields in the following order: Day of the year Month Day of the month Description of the holiday o The day-of-the-year field contains the number of the day of the year in which the holiday falls. It must be a number from 1 thru 365 (366 on a leap year like 1992). 4. The file systems that will be included for accounting information need to be configured in the "/etc/filesystems" file. For each file system that will Setup Of System Accounting In AIX 4.1 2 4.2 2 12/12/96, 4FAX #6832 be included, add the following information to its stanza: account = true 5. Indicate the data file that will be used for printer data by adding the following line to the /etc/qconfig stanza for that printer: acctfile = /var/adm/qacct NOTE: The printer accounting will not record usage for network printers, transparent printers, or PostScript printers. In addition, all print queues must use the same accounting file: /var/adm/qacct The pac command (printer accounting command) is more versatile because it allows separate accounting files for each printer. For more information, see InfoExplorer. 6. Create directories "/var/adm/acct/nite", "/var/adm/acct/fiscal", and "/var/adm/acct/sum" if they do not already exist. These directories should be owned by "adm" with a group ID of "adm". Use the following commands to create these directories: su - adm cd /var/adm/acct mkdir nite fiscal sum chown adm:adm nite fiscal sum chmod 755 nite fiscal sum exit 7. Modify the crontabs file for the "adm" user for auto- mated accumulation of accounting data. The crontabs file for the "adm" user is in: /var/spool/cron/crontabs/adm To edit the adm crontab, log on as the "root" and execute: su - adm -c crontab -e This will bring up the adm crontab in a vi session. You may need to uncomment or add some entries as well as modify times to suit your installation's time require- ments. An example of the entries needed follows: 10 23 * * 0-6 /usr/lib/acct/runacct 2>/usr/adm/acct/nite/accterr > /dev/null 0 23 * * 0-6 /usr/lib/acct/dodisk > /dev/null 2>&1 0 * * * * /usr/lib/acct/ckpacct > /dev/null 2>&1 15 4 1 * * /usr/lib/acct/monacct > /dev/null 2>&1 Setup Of System Accounting In AIX 4.1 3 4.2 3 12/12/96, 4FAX #6832 The first line starts runacct at 11:10 pm (10 23), each Sunday through Saturday (0-6). runacct runs the daily reporting. The second line starts disk accounting at 11:00 pm (0 23), each Sunday through Saturday (0-6), before starting runacct. The third line checks the /var/adm/pacct file to ensure that it does not get too large at 0 minutes past each hour (0 *) every day (*). If the free space in /var falls below 500 blocks, then ckpacct turns off accounting until space is made avail- able. This will result in loss of accounting data during the period that accounting is turned off. ckpacct will turn accounting on again when more space is available. THERE IS NO NOTIFICATION unless you set the MAILCOM variable. MAILCOM="mail root adm" You can set it in the ckpacct and runacct scripts or in the /etc/environment file. If MAILCOM is set in both places the setting in ckpacct and runacct will be used. The fourth line runs the monthly accounting reports at 4:15 am on the first of every month. 8. Turn on process accounting by adding the following line to the /etc/rc file. /usr/bin/su - root -c /usr/sbin/acct/startup The startup command records the time that accounting was turned on and cleans up the previous days accounting files. If you are not going to re-boot your system at this time - execute the above startup command from the root command line to start process accounting. FIELDS OF THE DAILY USAGE REPORT The meaning of the fields in the accounting Daily Usage Report are as follows: UID User ID number. LOGIN NAME Login name of user. CPU PRIME Cumulative CPU minutes during prime hours. CPU NPRIME Dring non-prime hours. KCORE PRIME Cumulative minutes spent in the kernel during prime hours. KCORE NPRIME Dring non-prime hours. Setup Of System Accounting In AIX 4.1 4 4.2 4 12/12/96, 4FAX #6832 BLKIO PRIME Cumulative blocks transferred during prime hours. BLKIO NPRIME Dring non-prime hours. RW/WR PRIME Cumulative blocks read/written during prime hours . RW/WR NPRIME During non-prime hours. CONNECT PRIME Cumulative connect time (minutes) during prime hours. CONNECT NPRIME During non-prime hours. DISK BLOCKS Cumulative disk usage. PRINT Queuing system charges (pages). FEES Fee for special services. # OF PROCS Count of processes. # OF SESS Count of login sessions. # OF SAMPLES Count of count of disk samples. FIXES / PROBLEMS Fixes for AIX 4.1 or 4.2 can be downloaded via Internet with the FixDist service. For FixDist information and instructions, order fax number 1228 from 1-800-IBM-4FAX. If you don't have access to Internet you can request a specific fix number or the latest bos.acct fileset from 1-800-CALL-AIX. All other services from 1-800-CALL-AIX which are not Program Services require a software support contract. On Very Large Systems o On large systems, if there are over 1000 users in the /etc/passwd file, the /usr/sbin/acct/dodisk script must be changed. At line 136 in dodisk, the diskusg command must be changed to read: diskusg -Unnnnn $args > dtmp where nnnnn is the new maximum number of users for which disk accounting should be done. (When the maximum number is too small, the dodisk script will return an error message that tells the user to use -uxxxx. It should say -Uxxxx.) DIAGNOSING PROBLEMS General Information Needed o Which accounting command is being used? Setup Of System Accounting In AIX 4.1 5 4.2 5 12/12/96, 4FAX #6832 a. acctcms e. acctmerg b. acctcom f. acctprc c. acctcon g. acctprc1 d. acctdisk h. acctprc2 o All of the accounting commands listed above accept input from standard input (i.e. acctcms < /usr/adm/pacct) and redirect to standard output (i.e. acctcmd < /usr/adm/pacct > /tmp/report). Find out which accounting file is being used as standard input and where the output is being directed. Defaults are standard in and standard out. acct_cmd < In_file > Out_file o Note all command flags used. Exact syntax is very important. o How is accounting started? via cron or via command line? o If accounting is started via cron, note the crontab file entries. These entries will be found in one of two places. If accounting is run from "root" then the file will be in /usr/spool/cron/crontabs/root. If accounting is run from adm then the file will be in /usr/spool/cron/crontabs/adm. When Accounting Fails 1. Check to see what state accounting is in. Look at the /usr/adm/acct/nite/active file. States are: setup wtmpfix connect1 connect2 process merge fees disk queueacct mergetacct cms userexit cleanup 2. Check accterr for additional messages. 3. Refer to section "Fixing General Accounting Problems" in InfoExplorer. Other Things to Check o Is /usr is out of space? o Does wtmp have records with inconsistent data stamps? o Is cron failing (check mail for root and adm)? Setup Of System Accounting In AIX 4.1 6 4.2 6 12/12/96, 4FAX #6832 READER'S COMMENTS Please fax this form to (512) 823-4009, attention "AIXServ Informa- tion". You may also e-mail comments to: elizabet@austin.ibm.com. These comments should include the same customer information requested below. Use this form to tell us what you think about this document. If you have found errors in it, or if you want to express your opinion about it (such as organization, subject matter, appearance) or make sug- gestions for improvement, this is the form to use. If you need technical assistance, contact your local branch office, point of sale, or 1-800-CALL-AIX (for information about support offer- ings). These services may be billable. Faxes on a variety of sub- jects may be ordered free of charge from 1-800-IBM-4FAX. Outside the U.S. call 415-855-4329 using a fax machine phone. When you send comments to IBM, you grant IBM a nonexclusive right to use or distribute your comments in any way it believes appropriate without incurring any obligation to you. NOTE: If you have a problem report or item number, supplying that number may help us determine why a procedure did or did not work in your specific situation. Problem Report or Item #: Branch Office or Customer #: Be sure to print your name and fax number below if you would like a reply: Name: Fax Number: ______________________________________________________________________ ______________________________________________________________________ ______________________________________________________________________ ______________________________________________________________________ ______________________________________________________________________ ______________________________________________________________________ ______________________________________________________________________ ______________________________________________________________________ ______________________________________________________________________ ______________________________________________________________________ ______________________________________________________________________ ______________________________________________________________________ END OF DOCUMENT (acct.setup.41-42.cmd, 4FAX# 6832) Setup Of System Accounting In AIX 4.1 7 4.2 7