Setup of System Accounting in AIX 3.2

Contents

About This Document

This document describes the accounting setup procedures for AIX Version 3.2.

The setup of system accounting as documented in the 3.2 AIX InfoExplorer has some errors. This document describes the Version 3.2 setup procedures and provides the corrections to enable system accounting under AIX version 3.2.

Access to the InfoExplorer and system documentation for AIX Version 3.2 require the setup person to be root. In this document, root user will be used for setting up system accounting and the user adm for running the reports.

Modify the root user .profile to provide access to the required executables. Modification of the root profile is optional, but will probably help with administration.

Related Documentation

What to Install to Get Accounting Working on a System

Make sure the following product is installed:

 
    bosext2.acct.obj - 'lslpp -l bosext2.acct.obj' 

This command should report the state as COMMITTED or APPLIED if the fileset is installed. To get the latest level accounting software, refer to the section "Fixes and Problems" later in this document.

Steps for Modifying the Root User Profile

Steps for Setting Up System Accounting

1. Log in to the system as root user. As described previously, root is the accounting administrator.

2. Enter:

      su - adm -c /usr/lib/acct/nulladm  /var/adm/wtmp  /var/adm/pacct 
   

   This command ensures correct permissions and provides access to the wtmp and pacct files.

3. Update the /etc/acct/holidays file for the current year using a favorite text editor. The following notes will help clarify the format of this file:
   • An asterisk (*) in column 1 denotes a comment.
   • Define prime time on the first data line (the first line that is not a comment) using a 24-hour clock. The line will consist of three 4-digit fields, in the following order:
     • current year
     • when (hhmm) prime time begins
     • when (hhmm) prime time ends

     Leading blanks are ignored. Midnight can be entered as either 0000 or 2400.

     For example, to specify the year 1992 with prime time beginning at 8:00 a.m. and ending at 5:00 p.m., specify:

        1992       0800       1700 
     

   • Define the company holidays for the year on the next data line. Each line contains four fields in the following order:
     • day of the year
     • month
     • day of the month
     • description of the holiday
     The day-of-the-year field contains the number of the day of the year in which the holiday falls. It must be a number from 1 through 365 (366 on a leap year like 1992).

4. The file systems that will be included for accounting information need to be configured in the /etc/filesystems file. For each file system that will be included, add the following information to its stanza:

    
      account = true 
   

5. Indicate the data file that will be used for printer data by adding the following line to the /etc/qconfig stanza for that printer:

    
      acctfile = /var/adm/qacct 
   

   This entry must be added to the queue stanza and not the device stanza. If the entry is added by editing the /etc/qconfig file, enter the following command to re-digest the qconfig file:

       enq -d 
   

   Another method of adding this entry to the qconfig file would be to enter the command smitty chque. Then follow the next steps:

   1. Select queue name.
   2. Enter /var/adm/qacct for the ACCOUNTING FILE pathname.

   These steps will update the appropriate stanza in /etc/qconfig file and will re-digest the qconfig file.

   NOTE: The printer accounting will not record usage for network printers, transparent printers, or PostScript printers. In addition, all print queues must use the same accounting file:

    
      /var/adm/qacct 
   

   The pac command (printer accounting command) is more versatile because it allows separate accounting files for each printer. For more information, see InfoExplorer.

6. Create directories /var/adm/acct/nite, /var/adm/acct/fiscal, and /var/adm/acct/sum if they do not already exist. These directories should be owned by the user adm with a group ID of "adm". Use the following series of commands to create these directories:

      su - adm 
      cd /var/adm/acct 
      mkdir nite fiscal sum 
      chown adm:adm nite fiscal sum 
      chmod 755 nite fiscal sum 
      exit 
   

7. Modify the crontabs file for the adm user for automated accumulation of accounting data. The crontabs file for the adm user is in /var/spool/cron/crontabs/adm.

   To edit the adm crontab, log on as root and enter:

      su - adm -c crontab -e 
   

   This will bring up the adm crontabfile in a vi session. You may need to uncomment or add some entries, and times may need to be modified to suit the installation's time requirements. An example of the entries needed is as follows:

   10 23 * * 0-6 /usr/lib/acct/runacct 2> \ 
      /usr/adm/acct/nite/accterr > /dev/null 
   0 23 * * 0-6 /usr/lib/acct/dodisk > /dev/null 2>&1 
   0 * * * * /usr/lib/acct/ckpacct > /dev/null 2>&1 
   15 4 1 * * /usr/lib/acct/monacct > /dev/null 2>&1 
   

   • The first line starts runacct at 11:10 pm (10 23), each Sunday through Saturday (0-6). runacct runs the daily reporting.
   • The second line starts disk accounting at 11:00 pm (0 23), each Sunday through Saturday (0-6), before starting runacct.
   • The third line checks the /var/adm/pacct file to ensure that it does not get too large at 0 minutes past each hour (0 *) every day (*).

     If the free space in /var falls below 500 blocks, then ckpacct turns off accounting until space is made available. A loss of accounting data will result during the period that accounting is turned off. ckpacct will turn accounting on again when more space is available. THERE IS NO NOTIFICATION unless the MAILCOM variable is set as follows:

        MAILCOM="mail root adm" 
     

     The variable can be set in the ckpacct and runacct scripts or in the /etc/environment file. If MAILCOM is set in both places the setting in ckpacct and runacct will be used.

   • The fourth line runs the monthly accounting reports at 4:15 am on the first of every month.

8. Turn on process accounting by adding the following line to the /etc/rc file.

    
        /usr/bin/su - root  -c  /usr/sbin/acct/startup 
   

   The startup command records the time that accounting was turned on and cleans up the previous day's accounting files.

   If the system is not going to be rebooted at this time, run the preceding startup command from the root command line to start process accounting.

Fields of the Daily Usage Report

The meaning of the fields in the accounting Daily Usage Report are as follows:

UID

User ID number

LOGIN NAME

Login name of user

CPU PRIME

Cumulative CPU minutes during prime hours

CPU NPRIME

During non-prime hours

KCORE PRIME

Cumulative minutes spent in the kernel during prime hours

KCORE NPRIME

During non-prime hours

BLKIO PRIME

Cumulative blocks transferred during prime hours

BLKIO NPRIME

During non-prime hours

RW/WR PRIME

Cumulative blocks read/written during prime hours

RW/WR NPRIME

During non-prime hours

CONNECT PRIME

Cumulative connect time (minutes) during prime hours

CONNECT NPRIME

During non-prime hours

DISK BLOCKS

Cumulative disk usage

PRINT

Queuing system charges (pages)

FEES

Fee for special services

# OF PROCS

Count of processes

# OF SESS

Count of login sessions

# OF SAMPLES

Count of count of disk samples

Fixes and Problems

Fixes for AIX Version 3.2.5 and later can be downloaded via the Internet with the FixDist service.

On very large systems, if there are over 1000 users in the /etc/passwd file, the /usr/sbin/acct/dodisk script must be changed. At line 136 in dodisk, the diskusg command must be changed to read as follows:

diskusg -Unnnnn $args > dtmp 

nnnnn is the new maximum number of users for which disk accounting should be done. (When the maximum number is too small, the dodisk script will return an error message that tells the user to use -uxxxx. It should say -Uxxxx.)

On AIX 3.2.5 and Greater

• IX38748 corrects the problem of a user missing the output from individual users for the CPU and DASD output.
• IX39408 corrects the problem of process accounting failing on a diskless workstation.
• IX42292 corrects the problem of the runacct account command truncating the wtmp file during its nightly run, causing connection accounting to be lost for users who do not log off.
• IX40232 corrects the problem of daily and monthly per-user memory accounting being off by a factor of exactly 200.
• IX42322 corrects the problem of a 64MB limit on system process accounting. With this problem, any process that used more than 64MB of memory caused an overflow, and the process size reported by the ac_mem field was inaccurate.
• IX43161 corrects the problem of acctprc2 core dumping with more than 500 users.
• IX41228 corrects the problem of acctdisk entering into an infinite loop if the input file is corrupted.
• IX40305 corrects the problem of the /var/adm/acct/sum/login log file not being updated in 3.2.5.

Diagnosing Problems

General Information Needed

• Which accounting command is being used?

      acctcms           acctmerg 
      acctcom           acctprc 
      acctcon           acctprcl 
      acctdisk          acctprc2 
  

  All of these accounting commands accept input from standard input (as in acctcms < /usr/adm/pacct) and redirect to standard output (as in acctcmd < /usr/adm/pacct > /tmp/report). Find out which accounting file is being used as standard input and where the output is being directed by entering:

       acct_cmd < In_file > Out_file 
  

• Defaults are standard in and standard out. Exact syntax is very important.

• How is accounting started, via cron or via command line?
  If accounting is started via cron, note the crontab file entries. If accounting is run from root, then the entry is in /usr/spool/cron/crontabs/root. If accounting is run from adm, then the entry is in /usr/spool/cron/crontabs/adm.

When Accounting Fails

1. Check to see what state accounting is in. Look at the /usr/adm/acct/nite/active file. States are as follows:

   setup 
   wtmpfix 
   connect1 
   connect2 
   process 
   merge 
   fees 
   disk 
   queueacct 
   mergetacct 
   cms 
   userexit 
   cleanup 
   

2. Check accterr for additional messages.
3. Refer to section "How To Fix General Accounting Problems" in InfoExplorer.
4. Restart runaccount.

Other Items to Check

• Is the /usr directory out of space?
• Does wtmp have records with inconsistent data stamps?
• Is cron failing? (Check mail for root and adm.)