[ Previous | Next | Contents | Glossary | Home | Search ]
AIX Version 4.3 System Management Guide: Operating System and Devices

Fixing General Accounting Problems

You may encounter several different problems when using the accounting system. You may need to resolve file ownership and permissions problems.

This section describes how to fix general accounting problems:


You must have root user or adm group authority.

Fixing Incorrect File Permissions

To use the accounting system, file ownership and permissions must be correct. The adm administrative account owns the accounting command and scripts, except for /var/adm/acct/accton which is owned by root.

  1. To check file permissions using the ls command, enter:
    ls -l /var/adm/acct
    -rws--x--- 1 adm adm 14628 Mar 19 08:11 /var/adm/acct/fiscal
    -rws--x--- 1 adm adm 14628 Mar 19 08:11 /var/adm/acct/nite
    -rws--x--- 1 adm adm 14628 Mar 19 08:11 /var/adm/acct/sum
  2. Adjust file permissions with the chown command, if necessary. The permissions should be 755 (all permissions for owner and read and execute permissions for all others). Also, the directory itself should be write-protected from others. For example:
    1. Move to the /var/adm/acct directory using the following command:
      cd /var/adm/acct
    2. Change the ownership for the sum, nite, and fiscal directories to adm group authority using the following command:
      chown adm sum/* nite/* fiscal/*
      To prevent tampering by users trying to avoid charges, deny write permission for others on these files. Change the accton command's group owner to adm, and permissions to 710, that is, no permissions for others. (Processes owned by adm will be able to execute the accton command, but ordinary users will not.)

  3. The /var/adm/wtmp file must also be owned by adm. If /var/adm/wtmp is owned by root, you will see the following message during startup:
    /var/adm/acct/startup: /var/adm/wtmp: Permission denied
    To correct the ownership of /var/adm/wtmp, change ownership to the adm group by using the following command:
    chown adm /var/adm/wtmp

Fixing Errors

Processing the /var/adm/wtmp file may produce some warnings mailed to root. The wtmp file contains information collected by /etc/init and /bin/login and is used by accounting scripts primarily for calculating connect time (the length of time a user is logged in). Unfortunately, date changes confuse the program that processes the wtmp file. As a result, the runacct command will send mail to root and adm complaining of any errors after a date change since the last time accounting was run.

  1. Determine if you received any errors.

    The acctcon1 command outputs error messages that are mailed to adm and root by the runacct command. For example, if the acctcon1 command stumbles after a date change and fails to collect connect times, adm might get mail like the following mail message:

    Mon Jan 6 11:58:40 CST 1992
    acctcon1: bad times: old: Tue Jan 7 00:57:14 1992
    new: Mon Jan 6 11:57:59 1992
    acctcon1: bad times: old: Tue Jan 7 00:57:14 1992
    new: Mon Jan 6 11:57:59 1992
    acctcon1: bad times: old: Tue Jan 7 00:57:14 1992
    new: Mon Jan 6 11:57:59 1992
  2. Adjust the wtmp file.
    /usr/sbin/acct/wtmpfix wtmp
    The wtmpfix command examines the wtmp file for date and time-stamp inconsistencies and corrects problems that could make acctcon1 fail. However, some date changes slip by wtmpfix. See "Fixing wtmp Errors" .

  3. Run accounting right before shutdown or immediately after startup.

    Using the runacct command at these times minimizes the number of entries with bad times. The runacct command will continue to send mail to the root and adm accounts, until you edit the runacct script, find the WTMPFIX section, and comment out the line where the file log gets mailed to the root and adm accounts.

Fixing Errors Encountered When Running the runacct Command

The runacct command processes files that are often very large. The procedure involves several passes through certain files and consumes considerable system resources while it is taking place. That's why the runacct command is normally run early in the morning when it can take over the machine and not disturb anyone.

The runacct command is a scrip divided into different stages. The stages allow you to restart the command where it stopped, without having to rerun the entire script.

When the runacct encounters problems, it sends error messages to different destinations depending on where the error occurred. Usually it sends a date and a message to the console directing you to look in the activeMMDD file (such as active0621 for June 21st) which is in the /usr/adm/acct/nite directory. When the runacct command aborts, it moves the entire active file to activeMMDD and appends a message describing the problem.

  1. Review the following error message tables for errors you have encountered when running the runacct command.

Preliminary State and Error Messages from the runnacct Command
State Command Fatal? Error Message Destinations
pre runacct yes * 2 CRONS or ACCT PROBLEMS * ERROR: locks found, run aborted console, mail, active
pre runacct yes runacct: Insufficient space in /usr ( nnn blks); Terminating procedure console, mail, active
pre runacct yes SE message; ERROR: acctg already run for 'date': check lastdate console, mail, activeMMDD
pre runacct no * SYSTEM ACCOUNTING STARTED * console
pre runacct no restarting acctg for 'date' at STATE console active, console
pre runacct no restarting acctg for 'date' at state (argument $2) previous state was STATE active
pre runacct yes SE message; Error: runacct called with invalid arguments console, mail, activeMMDD

States and Error Messages from the runacct Command
State Command Fatal? Error Message Destinations
SETUP runacct no ls -l fee pacct* /var/adm/wtmp active
SETUP runacct yes SE message; ERROR: turnacct switch returned rc=error console, mail, activeMMDD
SETUP runacct yes SE message; ERROR: SpacctMMDD already exists file setups probably already run activeMMDD
SETUP runacct yes SE message; ERROR: wtmpMMDD already exists: run setup manually console, mail, activeMMDD
WTMPFIX wtmpfix no SE message; ERROR: wtmpfix errors see xtmperrorMMDD activeMMDD, wtmperrorMMDD
WTMPFIX wtmpfix no wtmp processing complete active
CONNECT1 acctcon1 no SE message; (errors from acctcon1 log) console, mail, activeMMDD
CONNECT2 acctcon2 no connect acctg complete active
PROCESS runacct no WARNING: accounting already run for pacct N active
PROCESS acctprc1 acctprc2 no process acctg complete for SpacctNMMDD active
PROCESS runacct no all process actg complete for date active
MERGE acctmerg no tacct merge to create dayacct complete active
FEES acctmerg no merged fees OR no fees active
DISK acctmerg no merged disk records OR no disk records active
MERGEACCT acctmerg no WARNING: recreating sum/tacct active
MERGEACCT acctmerg no updated sum/tacct active
CMS runacct no WARNING: recreating sum/cms active
CMS acctcms no command summaries complete active
CLEANUP runacct no system accounting completed at 'date' active
<wrong> runacct yes SE message; ERROR: invalid state, check STATE console, mail, activeMMDD
Note: The label <wrong> in the previous table does not represent a state, but rather a state other than the correct state that was written in the state file /usr/adm/acct/nite/statefile.

Summary of Message Destinations
Destination Description
console The /dev/console device
mail Message mailed to root and adm accounts
active The /usr/adm/acct/nite/active file
activeMMDD The /usr/adm/acct/nite/activeMMDD file
wtmperrMMDD The /usr/adm/acct/nite/wtmperrorMMDD file
STATE Current state in /usr/adm/acct/nite/statefile file
fd2log Any other error messages

The abbreviation MMDD stands for the month and day, such as 0102 for January 2. For example, a fatal error during the CONNECT1 process on January 2 would create the file active0102 containing the error message.

The abbreviation "SE message" stands for the standard error message such as:

********* ACCT ERRORS : see active0102 *********

Updating an Out-of-Date Holidays File

The acctcon1 command (started from the runacct command) sends mail to the root and adm accounts when the /usr/lib/acct/holidays file gets out of date. The holidays file is out of date after the last holiday listed has passed or the year has changed.

Update the out-of-date holidays file by editing the /var/adm/acct/holidays file to differentiate between prime and nonprime time.

Prime time is assumed to be the period when your system is most active, such as workdays. Saturdays and Sundays are always nonprime times for the accounting system, as are any holidays that you list.

The holidays file contains three types of entries: comments, the year and prime-time period, and a list of holidays as in the following example:

* Prime/Non-Prime Time Table for Accounting System
*   Curr       Prime             Non-Prime
*   Year       Start             Start
    1992       0830              1700
*   Day of     Calendar          Company
*   Year       Date              Holiday
*   1          Jan 1             New Year's Day
*   20         Jan 20            Martin Luther King Day
*   46         Feb 15            President's Day
*   143        May 28            Memorial Day
*   186        Jul 3             4th of July
*   248        Sep 7             Labor Day
*   329        Nov 24            Thanksgiving
*   330        Nov 25            Friday after
*   359        Dec 24            Christmas Eve
*   360        Dec 25            Christmas Day
*   361        Dec 26            Day after Christmas

The first noncomment line must specify the current year (as four digits) and the beginning and end of prime time, also as four digits each. The concept of prime and nonprime time only affects the way that the accounting programs process the accounting records.

If the list of holidays is too long, the acctcon1 command will generate an error, and you will need to shorten your list. You are safe with 20 or fewer holidays. If you want to add more holidays, just edit the holidays file each month.

[ Previous | Next | Contents | Glossary | Home | Search ]