Setting Up Network Accounting

You can use the extended accounting facility to capture statistics about network traffic in a log file. In this manner, you can maintain records of traffic for tracking, provisioning, consolidation, and billing purposes. Later, you can refer to the log file to obtain historical information about network use over a period of time.

To configure the extended accounting facility, you use the acctadm command.

How to Configure Extended Network Accounting

1. On the system with the interfaces whose network usage you want to track, become an administrator.

   For more information, see How to Obtain Administrative Rights in Oracle Solaris Administration: Security Services.

2. View the status of extended network accounting in the system.

   # acctadm net

   Four types of extended accounting can be enabled by the acctadm command:

   • Process accounting

   • Task accounting

   • Flow accounting for IP Quality of Service (IPQoS)

   • Network accounting for links and flows

   Specifying net displays the status of network accounting. If net is not used, then the status of all four accounting types is displayed.

   ---

   Note - Network accounting also applies to flows that are managed by the flowadm and flowstat commands as discussed in Managing Resources on Flows. Therefore, to set up accounting for these flows, use the net option with the acctadm command. Do not use the flow option that enables flow accounting and which applies to IPQoS configurations.

   ---

3. Enable extended accounting for network traffic.

   # acctadm -e extended -f filename net

   where filename includes the full path of the log file that will capture network traffic statistics. The log file can be created in any directory that you specify.

4. Verify that extended network accounting has been activated.

   # acctadm net

Example 22-11 Configuring Extended Accounting for Network Traffic

This example shows how to capture and display historical information about network traffic on datalinks and any configured flows on the system.

First, view the status of all accounting types as follows:

# acctadm
            Task accounting: inactive
       Task accounting file: none
     Tracked task resources: none
   Untracked task resources: extended
         Process accounting: inactive
    Process accounting file: none
  Tracked process resources: none
Untracked process resources: extended,host
            Flow accounting: inactive
       Flow accounting file: none
     Tracked flow resources: none
   Untracked flow resources: extended
            Network accounting: inactive
       Network accounting file: none
     Tracked Network resources: none
   Untracked Network resources: extended

The output shows that network accounting is not active.

Next, enable extended network accounting.

# acctadm -e extended -f /var/log/net.log net
# acctadm net
            Net accounting: active
       Net accounting file: /var/log/net.log
     Tracked net resources: extended
   Untracked net resources: none

After you have enabled network accounting, you can use the dlstat and flowstat commands to extract information from the log file. The following procedure explains the steps.

How to Obtain Historical Statistics on Network Traffic

Before You Begin

You must enable extended accounting for the network before you can display historical data about the network. Further, to display historical data about traffic on flows, you must first configure flows in the system as explained in Managing Resources on Flows.

1. On the system with the interfaces whose network usage you want to track, become an administrator.

   For more information, see How to Obtain Administrative Rights in Oracle Solaris Administration: Security Services.

2. To extract and display historical information about resource usage on datalinks, use the following command:

   # dlstat show-link -h [-a] -f filename [-d date] [-F format] [-s start-time] [-e end-time] [link]

   -h

   Displays a summary of historical information about resource usage by incoming and outgoing packets on datalinks.

   -a

   Displays resource usage on all datalinks, including those that have already been deleted after the data capture.

   -f filename

   Specifies the log file that was defined when network accounting was enabled with the acctadm command.

   -d

   Displays logged information for dates when information is available.

   -F format

   Displays the data in a specific format. Currently, gnuplot is the only supported format.

   -s start-time,

   -e end-time

   Display available logged information for a specified date and time range. Use the MM/DD/YYY,hh:mm:ss format. The hour (hh) must use the 24–hour clock notation. If you do not include the date, then data for the current date's time range is displayed.

   link

   Displays historical data for a specified datalink. If you do not use this option, then historical network data for all configured datalinks is displayed.

3. To extract and display historical information about network traffic on configured flows, use the following command:

   # flowstat -h [-a] -f filename [-d date] [-F format] [-s start-time] [-e end-time] [flow]

   -h

   Displays a summary of historical information about resource usage by incoming and outgoing packets on datalinks.

   -a

   Displays resource usage on all datalinks, including those that have already been deleted after the data capture.

   -f filename

   Specifies the log file that was defined when network accounting was enabled with the acctadm command.

   -d

   Displays logged information for dates when information is available.

   -F format

   Displays the data in a specific format. Currently, gnuplot is the only supported format.

   -s start-time,

   -e end-time

   Display available logged information for a specified date and time range. Use the MM/DD/YYY,hh:mm:ss format. The hour (hh) must use the 24–hour clock notation. If you do not include the date, then data for the current date's time range is displayed.

   link

   Displays historical data for a specified datalink. If you do not use this option, then historical network data for all configured datalinks is displayed.

   flow

   Displays historical data for a specified flow. If you do not use this option, then historical network data for all configured flows is displayed.

Example 22-12 Displaying Historical Information About Resource Usage on Datalinks

The following example shows historical statistics about network traffic and its use of resources on a specified datalink.

# dlstat show-link -h -f /var/log/net.log
LINK      DURATION  IPACKETS RBYTES      OPACKETS OBYTES      BANDWIDTH
e1000g0   80        1031     546908      0        0           2.44 Kbps

Example 22-13 Displaying Historical Information About Resource Usage on Flows

The following examples show different ways of displaying historical statistics about network traffic on a flow and its use of resources.

Display historical statistics of resource usage by traffic on a flow:

# flowstat -h -f /var/log/net.log
FLOW      DURATION  IPACKETS RBYTES      OPACKETS OBYTES      BANDWIDTH
flowtcp   100       1031     546908      0        0            43.76Kbps
flowudp   0         0        0           0        0            0.00Mbps

Display historical statistics of resource usage by traffic on a flow over a given date and time range.

# flowstat -h -s 02/19/2008,10:39:06 -e 02/19/2008,10:40:06 \ -f /var/log/net.log flowtcp

FLOW      START       END         RBYTES   OBYTES     BANDWIDTH
flowtcp   10:39:06    10:39:26    1546     6539        3.23 Kbps
flowtcp   10:39:26    10:39:46    3586     9922        5.40 Kbps
flowtcp   10:39:46    10:40:06    240      216       182.40 bps
flowtcp   10:40:06    10:40:26    0        0           0.00 bps

Display historical statistics of resource usage by traffic on a flow over a given date and time range. Display the information by using the gnuplot format.

# flowstat -h -s 02/19/2008,10:39:06 -e 02/19/2008,10:40:06 \ -F gnuplot -f /var/log/net.log flowtcp
# Time tcp-flow
10:39:06 3.23
10:39:26 5.40
10:39:46 0.18
10:40:06 0.00