Setup of System Accounting in AIX 4.x

Contents

This document describes the accounting setup procedures for AIX Versions 4.1, 4.2, and 4.3. Documentation requires the setup person to be the root user. In this document, the root user will be used for setting up system accounting and the user adm for running the reports.

Modify the root user .profile to provide access to the required executables. Modifying the root profile is optional, but will help with administration.

http://www.rs6000.ibm.com/resource/

Make sure the bos.acct fileset is installed. Enter:

    lslpp -l bos.acct

This command should report the state as COMMITTED or APPLIED if the fileset is installed. To get the latest level software for the bos.acct fileset, refer to the section Fixes and Problems in this document.

1. Log in as root.
2. Edit the .profile file with a favorite text editor.
3. Locate the PATH statement in the .profile file. It must include the /usr/sbin/acct and /var/adm/acct directories, as shown in the following example:

       PATH= /usr/bin:/etc:/usr/sbin:/usr/ucb:/usr/bin/X11:/sbin:
           /usr/sbin/acct:/var/adm/acct ; export PATH
   

4. Locate the export statement in the .profile file. If the PATH statement given above was not used, the PATH variable must be included.

1. Log in to the system as the root user. As described previously, root is the accounting administrator.

2. Enter:

      su - adm -c /usr/lib/acct/nulladm  /var/adm/wtmp  /var/adm/pacct
   

   This command ensures correct permissions and provides access to the wtmp and pacct files.

3. Update the /etc/acct/holidays file for the current year using a favorite text editor. The following notes will help clarify the format of this file.
   • An asterisk (*) in column 1 denotes a comment.
   • Define prime time on the first data line (the first line that is not a comment) using a 24-hour clock. The line will consist of three 4-digit fields, in the following order:
     • current year
     • when (hhmm) prime time begins
     • when (hhmm) prime time ends

     Leading blanks are ignored. Midnight can be entered as either 0000 or 2400.

     For example, to specify the year 1992 with prime time beginning at 8:00 a.m. and ending at 5:00 p.m., specify:

              1992       0800       1700
     

     • Define the company holidays for the year on the next data line. Each line contains four fields in the following order:
       • day of the year
       • month
       • day of the month
       • description of the holiday
       The day-of-the-year field contains the number of the day of the year in which the holiday falls. It must be a number from 1 through 365 (366 on a leap year like 1992).

   • The file systems that will be included for accounting information need to be configured in the /etc/filesystems file. For each file system that will be included, add the following information to its stanza:

         account = true
     

   • Indicate the data file that will be used for printer data by adding the following line to the /etc/qconfig stanza for that printer:

         acctfile = /var/adm/qacct
     

     This entry must be added to the queue stanza and not the device stanza. If the entry is added by editing the /etc/qconfig file, enter the following command to re-digest the qconfig file:

         enq -d
     

     NOTE: The printer accounting will not record usage for network printers, transparent printers, or PostScript printers. In addition, all print queues must use the same accounting file:

         /var/adm/qacct
     

     The pac command (printer accounting command) is more versatile because it allows separate accounting files for each printer.

   • Create directories /var/adm/acct/nite, /var/adm/acct/fiscal, and /var/adm/acct/sum if they do not already exist. These directories should be owned by the user adm with a group ID of "adm". Use the following series of commands to create these directories:

         su - adm
         cd /var/adm/acct
         mkdir nite fiscal sum
         chown adm:adm nite fiscal sum
         chmod 755 nite fiscal sum
         exit
     

   • Modify the crontabs file for the adm user for automated accumulation of accounting data. The crontabs file for the adm user is in /var/spool/cron/crontabs/adm.

     To edit the adm crontab, log in as root and enter:

         su - adm -c crontab -e
     

     This will bring up the adm crontab file in a vi session. You may need to uncomment or add some entries, and times may need to be modified to suit the installation's time requirements. An example of the entries needed is as follows:

     10 23 * * 0-6 /usr/lib/acct/runacct 2>/usr/adm/acct/nite/accterr >
        /dev/null
     0 23 * * 0-6 /usr/lib/acct/dodisk > /dev/null 2>&1
     0 * * * * /usr/lib/acct/ckpacct > /dev/null 2>&1
     15 4 1 * * /usr/lib/acct/monacct > /dev/null 2>&1
     

     • The first line starts runacct at 11:10 pm (10 23), each Sunday through Saturday (0-6). runacct runs the daily reporting.
     • The second line starts disk accounting at 11:00 pm (0 23), each Sunday through Saturday (0-6), before starting runacct.
     • The third line checks the /var/adm/pacct file to ensure that it does not get too large at 0 minutes past each hour (0 *) every day (*).

       If the free space in /var falls below 500 blocks, then ckpacct turns off accounting until space is made available. A loss of accounting data will result during the period that accounting is turned off. ckpacct will turn accounting on again when more space is available. THERE IS NO NOTIFICATION unless the MAILCOM variable is set as follows:

           MAILCOM="mail root adm"
       

       The variable can be set in the ckpacct and runacct scripts or in the /etc/environment file. If MAILCOM is set in both places, the setting in ckpacct and runacct will be used.

     • The fourth line runs the monthly accounting reports at 4:15 am on the first of every month.

   • Turn on process accounting by adding the following line to the /etc/rc file.

         /usr/bin/su - root  -c  /usr/sbin/acct/startup
     

     The startup command records the time that accounting was turned on and cleans up the previous day's accounting files.

     If the system is not going to be rebooted at this time, run the preceding startup command from the root command line to start process accounting.

The meaning of the fields in the accounting Daily Usage Report are as follows:

UID

User ID number

LOGIN NAME

Login name of user

CPU PRIME

Cumulative CPU minutes during prime hours

CPU NPRIME

During non-prime hours

KCORE PRIME

Cumulative minutes spent in the kernel during prime hours

KCORE NPRIME

During non-prime hours

BLKIO PRIME

Cumulative blocks transferred during prime hours

BLKIO NPRIME

During non-prime hours

RW/WR PRIME

Cumulative blocks read/written during prime hours

RW/WR NPRIME

During non-prime hours

CONNECT PRIME

Cumulative connect time (minutes) during prime hours

CONNECT NPRIME

During non-prime hours

DISK BLOCKS

Cumulative disk usage

PRINT

Queuing system charges (pages)

FEES

Fee for special services

# OF PROCS

Count of processes

# OF SESS

Count of login sessions

# OF SAMPLES

Count of disk samples

Fixes for AIX Versions 4.1, 4.2, or 4.3 can be downloaded via the Internet with the FixDist service.

    diskusg -Unnnnn $args > dtmp

nnnnn is the new maximum number of users for which disk accounting should be done. (When the maximum number is too small, the dodisk script displays a message to use -Uxxxx.)

General Information Needed

• Which accounting command is being used?

      acctcms       acctmerg
      acctcom       acctprc
      acctcon       acctprc1
      acctdisk      acctprc2
  

  All of these accounting commands accept input from standard input (as in acctcms < /usr/adm/pacct) and redirect to standard output (as in acctcmd < /usr/adm/pacct > /tmp/report). Find out which accounting file is being used as standard input and where the output is being directed by entering:

      acct_cmd < In_file > Out_file
  

• Defaults are standard in and standard out. Exact syntax is very important.

• How is accounting started, via cron or via the command line?

  If accounting is started via cron, note the crontab file entries. If accounting is run from root, then the entry is in /usr/spool/cron/crontabs/root. If accounting is run from adm then the entry is in /usr/spool/cron/crontabs/adm.

When Accounting Fails

1. Check to see what state accounting is in. Look at the /usr/adm/acct/nite/active file. States are as follows:

        setup
        wtmpfix
        connect1
        connect2
        process
        merge
        fees
        disk
        queueacct
        mergetacct
        cms
        userexit
        cleanup
   

2. Check accterr for additional messages.

Other Items to Check

• Is the /usr directory out of space?
• Does wtmp have records with inconsistent data stamps?
• Is cron failing? (Check mail for root and adm.)