This section contains some simple procedures for setting up and maintaining system accounting.
This is a list of the step-by-step instructions in this chapter.
You can set up system accounting to run while the system is in multiuser mode (system state 2). Generally, this involves:
Creating /etc/rc0.d/K22acct and /etc/rc2.d/S22acct
Modifying /var/spool/cron/crontabs/adm and /var/spool/cron/crontabs/root
Most of the accounting scripts are added to the /var/spool/cron/crontabs/adm database file. The following table describes the default accounting scripts.
Table 31-1 Default Accounting Scripts
Accounting Script ... |
Is Used To ... |
And Runs ... |
---|---|---|
Check the size of the /usr/adm/pacct log file |
Periodically |
|
Process connect, disk, and fee accounting information |
Daily |
|
Generate fiscal reports and is run once per period |
On a fiscal basis |
You can change these defaults. After these entries have been added to the database and the accounting programs have been installed, accounting should run automatically.
Become superuser.
If necessary, install the SUNWaccr and SUNWaccu packages on your system by using the pkgadd command.
Install /etc/init.d/acct as the startup script for Run Level 2.
# ln /etc/init.d/acct /etc/rc2.d/S22acct |
Install /etc/init.d/acct as the stop script for Run Level 0.
# ln /etc/init.d/acct /etc/rc0.d/K22acct |
Add the following lines to the adm crontab file to start the ckpacct, runacct, and monacct programs automatically.
# EDITOR=vi; export EDITOR # crontab -e adm 0 * * * * /usr/lib/acct/ckpacct 30 2 * * * /usr/lib/acct/runacct 2> /var/adm/acct/nite/fd2log 30 7 1 * * /usr/lib/acct/monacct |
Add the following line to the root crontab file to start the dodisk program automatically.
# crontab -e 30 22 * * 4 /usr/lib/acct/dodisk |
Edit /etc/acct/holidays to include national and local holidays.
Reboot the system, or type:
# /etc/init.d/acct start |
The following example shows how the crontab entries that run /usr/lib/acct/ckpacct, /usr/lib/acct/runacct, and /usr/lib/acct/monacct have been added to /var/spool/cron/crontabs/adm.
#ident "@(#)adm 1.5 92/07/14 SMI" /* SVr4.0 1.2 */ # # The adm crontab file should contain startup of performance # collection if the profiling and performance feature has been # installed. 0 * * * * /usr/lib/acct/ckpacct 30 2 * * * /usr/lib/acct/runacct 2> /var/adm/acct/nite/fd2log 30 7 1 * * /usr/lib/acct/monacct |
The following example shows how the crontab entry that runs /usr/lib/acct/dodisk has been added to /var/spool/cron/crontabs/root.
#ident "@(#)root 1.16 98/04/28 SMI" /* SVr4.0 1.1.3.1 */ # # The root crontab should be used to perform accounting data collection. # # The rtc command is run to adjust the real time clock if and when # daylight savings time changes. # 10 3 * * 0,4 /etc/cron.d/logchecker 10 3 * * 0 /usr/lib/newsyslog 15 3 * * 0 /usr/lib/fs/nfs/nfsfind 1 2 * * * [ -x /usr/sbin/rtc ] && /usr/sbin/rtc -c > /dev/null 2>&1 30 3 * * * [ -x /usr/lib/gss/gsscred_clean ] && /usr/lib/gss/gsscred_clean 30 22 * * 4 /usr/lib/acct/dodisk |
The following example shows a sample /etc/acct/holidays file.
* @(#)holidays January 1, 1999 * * Prime/Nonprime Table for UNIX Accounting System * * Curr Prime Non-Prime * Year Start Start * 1999 0800 1800 * * only the first column (month/day) is significant. * * month/day Company * Holiday * 1/1 New Years Day 7/4 Indep. Day 12/25 Christmas |
If you provide special user services on a request basis, such as restoring files or remote printing, you may want to bill users by running a utility called chargefee(1M). chargefee records charges in the file /var/adm/fee. Each time the runacct utility is executed, new entries are merged into the total accounting records.
Charge a user for special services.
# chargefee username amount |
username |
User account you want to bill. |
amount |
Number of units to bill the user. |
The following example charges the user print_customer 10 units.
# chargefee print_customer 10 |
This section describes how to maintain accounting information.
Unfortunately, the UNIX accounting system is not foolproof. Occasionally, a file will become corrupted or lost. Some of the files can simply be ignored or restored from backup. However, certain files must be fixed to maintain the integrity of the accounting system.
The wtmpx(4) files seem to cause the most problems in the day-to-day operation of the accounting system. When the date is changed and the system is in multiuser mode, a set of date change records is written into /var/adm/wtmpx. The wtmpfix(1M) utility is designed to adjust the time stamps in the wtmp records when a date change is encountered. However, some combinations of date changes and reboots will slip through wtmpfix and cause acctcon to fail. For instructions on correcting wtmpx problems, see the following procedure..
Become superuser.
Change to the /var/adm/acct/nite directory.
Convert the binary file wtmp.MMDD into the ASCII file xwtmp.
# fwtmp wtmp.MMDD xwtmp |
MMDD |
Pair of two-digit numbers representing the month and day. |
Edit xwtmp. Delete the corrupted files, or delete all records from the beginning up to the date change.
Convert the ASCII file xwtmp to a binary file, overwriting the corrupted file.
# fwtmp -ic xwtmp wtmp.MMDD |
The integrity of /var/adm/acct/sum/tacct is important if you are charging users for system resources. Occasionally, mysterious tacct records appear with negative numbers, duplicate user IDs, or a user ID of 65535. First, check /var/adm/acct/sum/tacctprev, using prtacct to print it. If the contents look all right, patch the latest /var/adm/acct/sum/tacct.MMDD file, then recreate the /var/adm/acct/sum/tacct file. The following steps outline a simple patch procedure.
Become superuser.
Change to the /var/adm/acct/sum directory.
Convert the contents of tacct.MMDD from binary to ASCII format.
# acctmerg -v tacct.MMDD xtacct |
MMDD |
Month and day specified by two-digit numbers. |
Edit the xtacct file, removing bad records and writing duplicate records to another file.
Convert the xtacct file from ASCII format to binary.
# acctmerg -i xtacct tacct.MMDD |
MMDD |
Month and day specified by two-digit numbers. |
Merge the files tacct.prev and tacct.MMDD into the file tacct.
# acctmerg tacctprev tacct.MMDD tacct |
The runacct program can fail for a variety of reasons, the most common being a system crash, /var running out of space, or a corrupted wtmpx file. If the activeMMDD file exists, check it first for error messages. If the active and lock files exist, check fd2log for any mysterious messages.
Called without arguments, runacct assumes that this is the first invocation of the day. The argument MMDD is necessary if runacct is being restarted and specifies the month and day for which runacct will rerun the accounting. The entry point for processing is based on the contents of statefile. To override statefile, include the desired state on the command line.
When running the runacct program manually, be sure to run it as user adm.
Remove the lastdate file and any lock* files, if any.
$ cd /var/adm/acct/nite $ rm lastdate lock* |
Restart the runacct program.
$ runacct MMDD [state] 2> /var/adm/acct/nite/fd2log & |
MMDD |
Month and day specified by two-digit numbers. |
state |
Specifies a state, or starting point, where runacct processing should begin. |
You can temporarily stop system accounting or disable it permanently.
Become superuser.
Edit the adm crontab file to stop the ckpacct, runacct, and monacct programs from running by commenting out the appropriate lines.
# EDITOR=vi; export EDITOR # crontab -e adm #0 * * * * /usr/lib/acct/ckpacct #30 2 * * * /usr/lib/acct/runacct 2> /var/adm/acct/nite/fd2log #30 7 1 * * /usr/lib/acct/monacct |
Edit the crontab file for user root to stop the dodisk program from running by commenting out the appropriate line.
# crontab -e #30 22 * * 4 /usr/lib/acct/dodisk |
Stop the accounting program.
# /etc/init.d/acct stop |
To re-enable system accounting, remove the newly added comment symbols from the crontab files and restart the accounting program.
# /etc/init.d/acct start |
Become superuser.
Edit the adm crontab file and delete the entries for the ckpacct, runacct, and monacct programs.
# EDITOR=vi; export EDITOR # crontab -e adm |
Edit the root crontab file and delete the entries for the dodisk program.
# crontab -e |
Remove the startup script for Run Level 2.
# unlink /etc/rc2.d/S22acct |
Remove the stop script for Run Level 0.
# unlink /etc/rc0.d/K22acct |
Stop the accounting program.
# /etc/init.d/acct stop |