The accounting system utility allows you to collect and report on individual and group use of various system resources.
This accounting information can be used to bill users for the system resources they utilize, and to monitor selected aspects of the system's operation. To assist with billing, the accounting system provides the resource-usage totals defined by members of the adm group, and, if the chargefee command is included, factors in the billing fee.
The accounting system also provides data to assess the adequacy of current resource assignments, set resource limits and quotas, forecast future needs, and order supplies for printers and other devices.
The following information should help you understand how to implement the accounting utility in your system:
For data to be collected automatically, a member of the adm group needs to follow the procedures described in "Setting Up an Accounting System". These procedures enable the cron daemon to run the commands that generate data on:
The system writes a record of each session and process after they are completed. These records are converted into total accounting (tacct) records arranged by user and merged into a daily report. Periodically, the daily reports are combined to produce totals for the defined fiscal period. Methods for collecting and reporting the data and the various accounting commands and files are discussed in the following sections.
Although most of the accounting data is collected and processed automatically, a member of the adm group can enter certain commands from the keyboard to obtain specific information. These commands are discussed in "Keyboard Commands".
There are several types of accounting data: connect-time data, process data, disk-usage data, printer-usage data, and fee data. Each is described in the following paragraphs.
Connect-time data is collected by the init command and the login command. When you log in, the login program writes a record in the /etc/utmp file. This record includes your user name, the date and time of the login, and the login port. Commands, such as who, use this file to find out which users are logged into the various display stations. If the /var/adm/wtmp connect-time accounting file exists, the login command adds a copy of this login record to it.
When your login program ends (normally when you log out), the init command records the end of the session by writing another record in the /var/adm/wtmp file. Logout records differ from login records in that they have a blank user name. Both the login and logout records have the form described in the utmp.h file.
The acctwtmp command also writes special entries in the /var/adm/wtmp file concerning system shutdowns and startups.
For more information, see "Connect-Time Reports" .
The system collects data on resource usage for each process as it runs. These data include:
The accton command records these data in a specified file, usually the /var/adm/pacct file.
Related commands are the startup command, the shutacct command, the dodisk command, the ckpacct command, and the turnacct command.
For more information, see "Reporting Accounting Data" .
Much accounting information is collected as the resources are consumed. The dodisk command, run as specified by the cron daemon, periodically writes disk-usage records for each user to the /var/adm/acct/nite/dacct file. To accomplish this, the dodisk command calls other commands. Depending upon the thoroughness of the accounting search, the diskusg command or the acctdusg command can be used to collect data. The acctdisk command is used to write a total accounting record. The total accounting record, in turn, is used by the acctmerg command to prepare the daily accounting report.
The dodisk command charges a user for the links to files found in the user's login directory and evenly divides the charge for each file between the links. This spreads the cost of using a file over all who use it and removes the charges from users when they relinquish access to a file.
For more information, see "Disk-Usage Accounting Report" .
The collection of printer-usage data is a cooperative effort between the enq command and the queuing daemon. The enq command enqueues the user name, job number, and the name of the file to be printed. After the file is printed, the qdaemon command writes an ASCII record to a file, usually the /var/adm/qacct file, containing the user name, user number, and the number of pages printed. You can sort these records and convert them to total accounting records.
For more information, see "Printer-Usage Accounting Report" .
You can enter the chargefee command to produce an ASCII total accounting record in the /var/adm/fee file. This file will be added to daily reports by the acctmerg command.
For more information, see "Fee Accounting Report" .
After the various types of accounting data are collected, the records are processed and converted into reports.
Accounting commands automatically convert records into scientific notation when numbers become large. A number is represented in scientific notation in the following format:
which is the number equal to the Base number multiplied by 10 to the +Exp or -Exp power. For example, the scientific notation 1.345e+9 is equal to 1.345x109, or 1,345,000,000. And the scientific notation 1.345e-9 is equal to 1.345x10-9 or, .000000001345.
The runacct command calls two commands, acctcon1 and acctcon2, to process the login, logout, and system-shutdown records that collect in the /var/adm/wtmp file. The acctcon1 command converts these records into session records and writes them to the /var/adm/acct/nite/lineuse file. The acctcon2 command then converts the session records into a total accounting record, /var/adm/logacct, that the acctmerg command adds to daily reports.
If you run the acctcon1 command from the command line, you must include the -l flag to produce the line-use report, /var/adm/acct/nite/lineuse. To produce an overall session report for the accounting period, /var/adm/acct/nite/reboots, use the acctcon1 command with the -o flag.
The lastlogin command produces a report that gives the last date on which each user logged in.
Two commands process the billing-related data that was collected in the /var/adm/pacct or other specified file. The acctprc1 command translates the user ID into a user name and writes ASCII records containing the chargeable items (prime and non-prime CPU time, mean memory size, and I/O data). The acctprc2 command transforms these records into total accounting records that are added to daily reports by the acctmerg command.
Process accounting data also provides information that you can use to monitor system resource usage. The acctcms command summarizes resource use by command name. This provides information on how many times each command was run, how much processor time and memory was used, and how intensely the resources were used (also known as the hog factor). The acctcms command produces long-term statistics on system utilization, providing information on total system usage and the frequency with which commands are used.
The acctcom command handles the same data as the acctcms command, but provides detailed information about each process. You can display all process accounting records or select records of particular interest. Selection criteria include the load imposed by the process, the time period when the process ended, the name of the command, the user or group that invoked the process, and the port at which the process ran. Unlike other accounting commands, acctcom can be run by all users.
The disk-usage records collected in the /var/adm/acct/nite/dacct file are merged into the daily accounting reports by the acctmerg command.
The ASCII record in the /var/adm/qacct file can be converted to a total accounting record to be added to the daily report by the acctmerg command.
If you used the chargefee command to charge users for services such as file restores, consulting, or materials, an ASCII total accounting record is written in the /var/adm/fee file. This file is added to the daily reports by the acctmerg command.
Raw accounting data on connect-time, processes, disk usage, printer usage, and fees to charge are merged into daily reports by the acctmerg command. Called by the runacct command as part of its daily operation, the acctmerg command produces the following:
|/var/adm/acct/nite/dacct||An intermediate report that is produced when one of the input files is full.|
|/var/adm/acct/sum/tacct||A cumulative total report in tacct format. This file is used by the monacct command to produce the ASCII monthly summary.|
The acctmerg command can convert records between ASCII and binary formats and merge records from different sources into a single record for each user.
Called by the cron daemon, the monacct command produces the following:
|/var/adm/acct/fiscal||A periodic summary report produced from the /var/adm/acct/sum/tacct report by the monacct command. The monacct command can be configured to run monthly or at the end of a fiscal period.|
The accounting commands function several different ways. Some commands:
Several commands usually run by the cron daemon automatically collect accounting data.
|Handles the main daily accounting procedure. Normally initiated by the cron daemon during non-prime hours, the runacct command calls several other accounting commands to process the active data files and produce command and resource usage summaries, sorted by user name. It also calls the acctmerg command to produce daily summary report files, and the ckpacct command to maintain the integrity of the active data files.|
|Handles pacct file size. It is advantageous to have several smaller pacct files if you must restart the runacct procedure after a failure in processing these records. The ckpacct command checks the size of the /var/adm/pacct active data file, and if the file is larger than 500 blocks, the command invokes the turnacct switch command to turn off process accounting temporarily. The data is transferred to a new pacct file, /var/adm/pacct x. (x is an integer that increases each time a new pacct file is created.) If the number of free disk blocks falls below 500, the ckpacct command calls the turnacct off command to turn off process accounting.|
|Calls the acctdisk command and either the diskusg command or the acctdusg command to write disk-usage records to the /var/adm/acct/nite/dacct file. This data is later merged into the daily reports.|
|Produces a periodic summary from daily reports.|
|Collects and stores binary data in the /var/adm/sa/sa dd file, where dd is the day of the month.|
|Writes a daily report in the /var/adm/sa/sadd file, where dd is the day of the month. The command removes reports from the /var/adm/sa/sadd file that have been there longer than one week.|
Other commands are run automatically by procedures other than the cron daemon:
|When added to the /etc/rc file, the startup command initiates startup procedures for the accounting system.|
|Records the time accounting was turned off by calling the acctwtmp command to write a line to /var/adm/wtmp file. It then calls the turnacct off command to turn off process accounting.|
A member of the adm group can enter the following commands from the keyboard:
|Prints connect-time records. This command is provided for compatibility with Berkeley Software Distribution (BSD) systems.|
|Displays process accounting summaries. This command is also available to users.|
|Displays connect-time summaries. Either the -l flag or the -o flag must be used.|
|Turns process accounting on and off.|
|Charges the user a predetermined fee for units of work performed. The charges are added to the daily report by the acctmerg command.|
|Converts files between binary and ASCII formats.|
|Displays information about previous logins. This command is provided for compatibility with Berkeley Software Distribution (BSD) systems.|
|Displays information about the last commands that were executed. This command is provided for compatibility with Berkeley Software Distribution (BSD) systems.|
|Displays the time each user last logged in.|
|Prepares printer/plotter accounting records. This command is provided for compatibility with Berkeley Software Distribution (BSD) systems.|
|Displays a session record.|
|Displays total accounting files.|
|Summarizes raw accounting information to help manage large volumes of accounting information. This command is provided for compatibility with Berkeley Software Distribution (BSD) systems.|
|Reports on various local system actions, such as buffer usage, disk and tape I/O activity, TTY device activity counters, and file access counters.|
|Prints real time, user time, and system time required to execute a command.|
|Reports in seconds the elapsed time, user time, and execution time.|
|Writes to standard output the contents of selected cumulative activity counters in the operating system. The sar command reports only on local activities.|
There are two main accounting directories: the /usr/sbin/acct directory, where all the C language programs and shell procedures needed to run the accounting system are stored, and the /var/adm directory, which contains the data, report and summary files.
The accounting data files belong to members of the adm group, and all active data files (such as wtmp and pacct) reside in the adm home directory /var/adm.
Files in the /var/adm directory are:
|/var/adm/diskdiag||Diagnostic output during the execution of disk accounting programs.|
|/var/adm/dtmp||Output from the acctdusg command.|
|/var/adm/fee||Output from the chargefee command, in ASCII tacct records.|
|/var/adm/pacct||Active process accounting file.|
|/var/adm/wtmp||Active process accounting file.|
|/var/adm/Spacct .mmdd||Process accounting files for mmdd during the execution of the runacct command.|
Report and summary files reside in a /var/adm/acct subdirectory. You must create the following subdirectories before the accounting system is enabled. See "Setting Up an Accounting System" for more information.
|/var/adm/acct/nite||Contains files that the runacct command reuses daily.|
|/var/adm/acct/sum||Contains the cumulative summary files that the runacct command updates daily.|
|/var/adm/acct/fiscal||Contains the monthly summary files that the monacct command creates.|
The following report and summary files, produced by the runacct command, are of particular interest:
|/var/adm/acct/nite/lineuse||Contains usage statistics for each terminal line on the system. This report is especially useful for detecting bad lines. If the ratio between the number of logouts and logins exceeds about 3 to 1, there is a good possibility that a line is failing.|
|/var/adm/acct/nite/daytacct||Contains the total accounting file for the previous day.|
|/var/adm/acct/sum/tacct||Contains the accumulation of each day's nite/daytacct file and can be used for billing purposes. The monacct command restarts the file each month or fiscal period.|
|/var/adm/acct/sum/cms||Contains the accumulation of each day's command summaries. The monacct command reads this binary version of the file and purges it. The ASCII version is nite/cms.|
|/var/adm/acct/sum/daycms||Contains the daily command summary. An ASCII version is stored in nite/daycms.|
|/var/adm/acct/sum/loginlog||Contains a record of the last time each user ID was used.|
|/var/adm/acct/sum/rprt mmdd||This file contains a copy of the daily report saved by the runacct command.|
|active||Used by the runacct command to record progress and print warning and error messages. The file active. mmdd is a copy of the active file made by the runacct program after it detects an error.|
|cms||ASCII total command summary used by the prdaily command.|
|ctacct.mmdd||Connect total accounting records.|
|ctmp||Connect session records.|
|daycms||ASCII daily command summary used by the prdaily command.|
|daytacct||Total accounting records for one day.|
|dacct||Disk total accounting records, created by the dodisk command.|
|accterr||Diagnostic output produced during the execution of the runacct command.|
|lastdate||Last day the runacct executed, in date +%m%d format.|
|lock1||Used to control serial use of the runacct command.|
|lineuse||tty line usage report used by the prdaily command.|
|log||Diagnostic output from the acctcon1 command.|
|logmmdd||Same as log after the runacct command detects an error.|
|reboots||Contains beginning and ending dates from wtmp, and a listing of system restarts.|
|statefile||Used to record the current state during execution of the runacct command.|
|tmpwtmp||wtmp file corrected by the wtmpfix command.|
|wtmperror||Contains wtmpfix error messages.|
|wtmperrmmdd||Same as wtmperror after the runacct command detects an error.|
|wtmp.mmdd||Previous day's wtmp file.|
|cms||Total command summary file for the current fiscal period, in binary format.|
|cmsprev||Command summary file without the latest update.|
|daycms||Command summary file for the previous day, in binary format.|
|lastlogin||File created by the lastlogin command.|
|pacct.mmdd||Concatenated version of all pacct files for mmdd. This file is removed after system startup by the remove command.|
|rprtmmdd||Saved output of the prdaily command.|
|tacct||Cumulative total accounting file for the current fiscal period.|
|tacctprev||Same as tacct without the latest update.|
|tacctmmdd||Total accounting file for mmdd.|
|wtmp.mmdd||Saved copy of the wtmp file for mmdd. This file is removed after system startup by the remove command.|
|cms?||Total command summary file for the fiscal period, specified by ?, in binary format.|
|fiscrpt?||A report similar to that of the prdaily command for fiscal period, specified by ?, in binary format.|
|tacct?||Total accounting file for fiscal period, specified by ?, in binary format.|
Accounting file output and formats are summarized in the following.
|wtmp||Produces the active process accounting file. The format of the wtmp file is defined in the utmp.h file.|
|ctmp||Produces connect session records. The format is described in the ctmp.h file.|
|pacct*||Produces active process accounting records. The format of the output is defined in the /usr/include/sys/acct.h file.|
|Spacct*||Produces process accounting files for mmdd during the execution of the runacct command. The format of these files is defined in the sys/acct.h file.|
|daytacct||Produces total accounting records for one day. The format of the file is defined in the tacct file format.|
|sum/tacct||Produces binary file that accumulates each day's command summaries. The format of this file is defined in the /usr/include/sys/acct.h header file.|
|ptacct||Produces concatenated versions of pacct files. The format of these files are defined in the tacct file.|
|ctacct||Produces connect total accounting records. The output of this file is defined in the tacct file.|
|cms||Produces total accounting command summary used by the prdaily command, in binary format. The ASCII version is nite/cms.|
|daycms||Daily command summary used by the prdaily command, in binary format. The ASCII version is nite/daycms.|