|Skip Navigation Links|
|Exit Print View|
|Oracle Solaris 11.1 Administration: Oracle Solaris Zones, Oracle Solaris 10 Zones, and Resource Management Oracle Solaris 11.1 Information Library|
Users can manage extended accounting (start accounting, stop accounting, and change accounting configuration parameters) if they have the appropriate rights profile for the accounting type to be managed:
Extended Accounting Flow Management
To activate the extended accounting facility for tasks, processes, flows, and network components, use the acctadm command. The optional final parameter to acctadm indicates whether the command should act on the flow, process, system task, or network accounting components of the extended accounting facility.
Note - Roles contain authorizations and privileged commands. For information on how to create the role and assign the role to a user through the role-based access control (RBAC) feature of Oracle Solaris, see Part III, Roles, Rights Profiles, and Privileges, in Oracle Solaris 11.1 Administration: Security Services.
# acctadm -e extended -f /var/adm/exacct/proc process
# acctadm -e extended,mstate -f /var/adm/exacct/task task
# acctadm -e extended -f /var/adm/exacct/flow flow
# acctadm -e extended -f /var/adm/exacct/net net
Run acctadm on links and flows administered by the dladm and flowadm commands.
See acctadm(1M) for more information.
Type acctadm without arguments to display the current status of the extended accounting facility.
machine% acctadm Task accounting: active Task accounting file: /var/adm/exacct/task Tracked task resources: extended Untracked task resources: none Process accounting: active Process accounting file: /var/adm/exacct/proc Tracked process resources: extended Untracked process resources: host Flow accounting: active Flow accounting file: /var/adm/exacct/flow Tracked flow resources: extended Untracked flow resources: none
In the previous example, system task accounting is active in extended mode and mstate mode. Process and flow accounting are active in extended mode.
Note - In the context of extended accounting, microstate (mstate) refers to the extended data, associated with microstate process transitions, that is available in the process usage file (see proc(4)). This data provides substantially more detail about the activities of the process than basic or extended records.
Available resources can vary from system to system, and from platform to platform. Use the acctadm command with the -r option to view the accounting resource groups available on your system.
machine% acctadm -r process: extended pid,uid,gid,cpu,time,command,tty,projid,taskid,ancpid,wait-status,zone,flag, memory,mstatedisplays as one line basic pid,uid,gid,cpu,time,command,tty,flag task: extended taskid,projid,cpu,time,host,mstate,anctaskid,zone basic taskid,projid,cpu,time flow: extended saddr,daddr,sport,dport,proto,dsfield,nbytes,npkts,action,ctime,lseen,projid,uid basic saddr,daddr,sport,dport,proto,nbytes,npkts,action net: extended name,devname,edest,vlan_tpid,vlan_tci,sap,cpuid, \ priority,bwlimit,curtime,ibytes,obytes,ipkts,opks,ierrpkts \ oerrpkts,saddr,daddr,sport,dport,protocol,dsfield basic name,devname,edest,vlan_tpid,vlan_tci,sap,cpuid, \ priority,bwlimit,curtime,ibytes,obytes,ipkts,opks,ierrpkts \ oerrpkts
To deactivate process, task, flow, and network accounting, turn off each of them individually by using the acctadm command with the -x option.
# acctadm -x process
# acctadm -x task
# acctadm -x flow
# acctadm -x net
# acctadm Task accounting: inactive Task accounting file: none Tracked task resources: none Untracked task resources: extended Process accounting: inactive Process accounting file: none Tracked process resources: none Untracked process resources: extended Flow accounting: inactive Flow accounting file: none Tracked flow resources: none Untracked flow resources: extended Net accounting: inactive Net accounting file: none Tracked Net resources: none Untracked Net resources: extended