System Administration Guide, Volume 2

Chapter 32 System Accounting (Reference)

This is a list of reference information in this chapter.

Daily Accounting

Daily accounting can help you track four types of accounting: connect accounting, process accounting, disk accounting, and fee calculations.

Connect Accounting

Connect accounting enables you to determine the following:

The length of time a user was logged in
How the tty lines are being used
The number of reboots on your system
The frequency with which the accounting software was turned off and on

To provide this information, the system stores records of time adjustments, boot times, times the accounting software was turned off and on, changes in run levels, the creation of user processes (login processes and init processes), and the deaths of processes. These records (produced from the output of system programs such as date, init, login, ttymon, and acctwtmp) are stored in the /var/adm/wtmpx file. Entries in the wtmpx file may contain the following information: a user's login name, a device name, a process ID, the type of entry, and a time stamp denoting when the entry was made.

Process Accounting

Process accounting enables you to keep track of the following data about each process run on your system:

User and group IDs of those using the process
Beginning and elapsed times of the process
CPU time for the process (user time and system time)
Amount of memory used
Commands run
The tty controlling the process

Every time a process dies, the exit program collects this data and writes it to the /var/adm/pacct file.

Disk Accounting

Disk accounting enables you to gather and format the following data about the files each user has on disks:

Name and ID of the user
Number of blocks used by the user's files

This data is collected by the shell script /usr/lib/acct/dodisk at intervals determined by the entry you add to the /var/spool/cron/crontabs/root file. In turn, dodisk invokes the commands acctdusg and diskusg, which gather disk usage by login.

See "How to Set Up System Accounting" for more information about setting up dodisk.

The acctdusg(1M) command gathers all the disk accounting information. Each time it is invoked, this command can process a maximum of 3000 users.

Caution -

Information gathered by running dodisk(1M) is stored in the /var/adm/acct/nite/disktacct file. This information is overwritten the next time dodisk is run. Therefore, avoid running dodisk twice in the same day.

The diskusg command may overcharge for files that are written in random access fashion, which may create holes in the files. This is because diskusg does not read the indirect blocks of a file when determining its size. Rather, diskusg determines the size of a file by looking at the di_size value of the inode.

Calculating User Fees

The chargefee utility stores charges for special services provided to a user, such as file restoration, in the file /var/adm/fee. Each entry in the file consists of a user's login name, user ID, and the fee. This file is checked by the runacct program every day and new entries are merged into the total accounting records. For instructions on running chargefee to bill users, see "How to Bill Users".

How Daily Accounting Works

Here is a step-by-step summary of how daily accounting works:

When the system is switched into multiuser mode, the /usr/lib/acct/startup program is executed. The startup program executes several other programs that invoke accounting.

The acctwtmp program adds a "boot" record to /var/adm/wtmpx. In this record, the system name is shown as the login name in the wtmpx record. The following table summarizes how the raw accounting data is gathered and where it is stored.

Table 32-1 Raw Accounting Data


File in `/var/adm`	Information	Written By	Format
`wtmpx`	Connect sessions	`login`, `init`	`utmpx.h`
	Changes	`date`
	Reboots	`acctwtmp`
	Shutdowns	`shutacct` shell
`pacctn`	Processes	Kernel (when the process ends)	`acct.h`
		`turnacct switch` (creates a new file when the old one reaches 500 blocks)
`fee`	Special charges	`chargefee`	`acct.h`
`acct/nite/disktacct`	Disk space used	`dodisk`	`tacct.h`

The turnacct program, invoked with the -on option, begins process accounting. Specifically, turnacct executes the accton program with the /var/adm/pacct argument.
The remove shell script "cleans up" the saved pacct and wtmpx files left in the sum directory by runacct.
The login and init programs record connect sessions by writing records into /var/adm/wtmpx. Any date changes (using date with an argument) are also written to /var/adm/wtmpx. Reboots and shutdowns using acctwtmp are also recorded in /var/adm/wtmpx.
When a process ends, the kernel writes one record per process, using acct.h format, in the /var/adm/pacct file.

Every hour, cron executes the ckpacct program to check the size of /var/adm/pacct. If the file grows past 500 blocks (default), the turnacct switch is executed. (The program moves the pacct file and creates a new one.) The advantage of having several smaller pacct files becomes apparent when trying to restart runacct if a failure occurs when processing these records.
runacct is executed by cron each night. runacct processes the accounting files: /var/adm/pacctn, /var/adm/wtmpx, /var/adm/fee, and /var/adm/acct/nite/disktacct, to produce command summaries and usage summaries by login.
The /usr/lib/acct/prdaily program is executed on a daily basis by runacct to write the daily accounting information collected by runacct (in ASCII format) in /var/adm/acct/sum/rprt.MMDD.
The monacct program should be executed on a monthly basis (or at intervals determined by you, such as the end of every fiscal period). The monacct program creates a report based on data stored in the sum directory that has been updated daily by runacct. After creating the report, monacct "cleans up" the sum directory to prepare the directory's files for the new runacct data.

What Happens if the System Shuts Down

If the system is shut down using shutdown, the shutacct program is executed automatically. The shutacct program writes a reason record into /var/adm/wtmpx and turns off process accounting.

Accounting Reports

This section describes the various reports generated by the accounting software.

Daily Accounting Reports

The runacct(1M) shell script generates four basic reports upon each invocation. These reports cover the areas of connect accounting, usage by login on a daily basis, command usage reported by daily and monthly totals, and a report of the last time users were logged in. the following table describes the four basic reports generated.

Table 32-2 Daily Accounting Reports


Report Type	Description
Daily Report	Shows line utilization by `tty` number.
Daily Usage Report	Indicates usage of system resources by users (listed in order of UID).
Daily Command Summary	Indicates usage of system resources by commands, listed in descending order of use of memory (in other words, the command that used the most memory is listed first). This same information is reported for the month with the monthly total command summary.
Last Login	Shows the last time each user logged in (arranged in chronological order).

Daily Report

This report gives information about each terminal line used. A sample daily report appears below.

Jul  7 02:30:02 1999  DAILY REPORT FOR mercury Page 1
 
 
from Wed Jul 07 02:30:02 1999
to   Thu Jul 08 02:30:02 1999
1       system boot
1       run-level 3
1       acctg on
1       runacct
1       acctcon
 
TOTAL DURATION IS 1384 MINUTES
LINE         MINUTES  PERCENT  # SESS  # ON  # OFF
/dev/pts/5   0        0        0       0     0   
/dev/pts/6   0        0        0       0     1   
/dev/pts/7   0        0        0       0     0   
console      1337     97       1       1     1   
pts/3        0        0        0       0     1   
pts/4        0        0        0       0     1   
pts/5        3        0        2       2     3   
pts/6        232      17       5       5     5   
pts/7        54       4        1       1     2   
pts/8        0        0        0       0     1   
pts/9        0        0        0       0     1   
TOTALS       1625     --       9       9     16

The from and to lines specify the time period reflected in the report--the period from the time the last accounting report was generated until the time the current accounting report was generated. It is followed by a log of system reboots, shutdowns, power failure recoveries, and any other record dumped into /var/adm/wtmpx by the acctwtmp program. For more information, see acct(1M).

The second part of the report is a breakdown of line utilization. The TOTAL DURATION tells how long the system was in multiuser state (accessible through the terminal lines). The columns are described in the following table.

Table 32-3 Daily Report Data


Column	Description
`LINE`	The terminal line or access port.
`MINUTES`	The total number of minutes that the line was in use during the accounting period.
`PERCENT`	The total number of `MINUTES` the line was in use, divided into the `TOTAL` `DURATION`.
`# SESS`	The number of times this port was accessed for a login session.
`# ON`	Identical to `SESS`. (This column does not have much meaning anymore. Previously, it listed the number of times that a port was used to log in a user.)
`# OFF`	This column reflects the number of times a user logs out and any interrupts that occur on that line. Generally, interrupts occur on a port when `ttymon` is first invoked after the system is brought to multiuser state. If the `# OFF` exceeds the `# ON` by a large factor, the multiplexer, modem, or cable is probably going bad, or there is a bad connection somewhere. The most common cause of this is an unconnected cable dangling from the multiplexer.

During real time, you should monitor /var/adm/wtmpx because it is the file from which the connect accounting is geared. If the wtmpx file grows rapidly, execute acctcon -l file < /var/adm/wtmpx to see which tty line is the noisiest. If interruption is occurring frequently, general system performance will be affected. Additionally, wtmp may become corrupted. To correct this, see "How to Fix a wtmpx File".

Daily Usage Report

The daily usage report gives a breakdown of system resource utilization by user. A sample of this type of report appears below.

Jul  7 02:30:02 1999  DAILY USAGE REPORT FOR mercury Page 1
 
      LOGIN    CPU (MINS) KCORE-MINS  CONNECT (MINS) DISK  # OF  # OF # DISK FEE
UID   NAME   PRIME NPRIME PRIME NPRIME PRIME NPRIME  BLOCKS PROCS SESS SAMPLES
0     TOTAL  1     1      2017  717    785   840    660361  1067  9     7    20
0     root   1     1      1833  499    550   840    400443  408   2     1    0
1     daemon 0     0      0     0      0     0      400     0     0     1    0
2     bin    0     0      0     0      0     0      253942  0     0     1    0
3     sys    0     0      0     0      0     0      2       0     0     1    0
4     adm    0     0      46    83     0     0      104     280   0     1    0
5     uucp   0     0      74    133    0     0      1672    316   0     1    0
71    lp     0     0      0     2      0     0      3798    1     0     1    0
8198  ksm    0     0      8     0      0     0      0       6     1     0    0
52171 pjm    0     0      56    0      234   0      0       56    6     0    20

The data provided in the daily usage report is described in the following table.

Table 32-4 Daily Usage Report Data


Column	Description
`UID`	User identification number.
`LOGIN NAME`	Login name of the user. Identifies a user who has multiple login names.
`CPU-MINS`	Amount of time, in minutes, that the user's process used the central processing unit. Divided into `PRIME` and `NPRIME` (non-prime) utilization. The accounting system's version of this data is located in the `/etc/acct/holidays` file.
`KCORE-MINS`	A cumulative measure of the amount of memory in Kbyte segments per minute that a process uses while running. Divided into `PRIME` and `NPRIME` utilization.
`CONNECT-MINS`	Amount of time a user was logged into the system, or "real time." Divided into `PRIME` and `NPRIME` use. If these numbers are high while the `# OF PROCS` is low, you can conclude that the user logs in first thing in the morning and hardly touches the terminal the rest of the day.
`DISK BLOCKS`	Output from the `acctdusg` program, which runs and merges disk accounting programs and total accounting record (`daytacct`). (For accounting purposes, a block is 512 bytes.)
`# OF PROCS`	Number of processes invoked by the user. If large numbers appear, a user may have a shell procedure that has run out of control.
`# OF SESS`	Number of times a user logged on to the system.
`# DISK SAMPLES`	Number of times disk accounting was run to obtain the average number of `DISK BLOCKS`.
`FEE`	Often unused field that represents the total accumulation of units charged against the user by `chargefee`.

Daily Command Summary

The daily command summary report shows the system resource use by command. With this report, you can identify the most heavily used commands and, based on how those commands use system resources, gain insight on how best to tune the system. The format of the daily and monthly reports are virtually the same; however, the daily summary reports only on the current accounting period while the monthly summary reports on the start of the fiscal period to the current date. In other words, the monthly report is a cumulative summary that reflects the data accumulated since the last invocation of monacct.

These reports are sorted by TOTAL KCOREMIN, which is an arbitrary gauge but often a good one for calculating drain on a system.

A sample daily command summary appears below.

Jul  7 02:30:02 1999  DAILY COMMAND SUMMARY Page 1
 
                                   TOTAL COMMAND SUMMARY
COMMAND NUMBER    TOTAL    TOTAL    TOTAL   MEAN    MEAN    HOG    CHARS  BLOCKS
NAME     CMDS  KCOREMIN  CPU-MIN  REAL-MIN  SIZE-K  CPU-MIN FACTOR TRNSFD   READ
 
TOTALS   1067   2730.99    2.01    1649.38 1361.41   0.00  0.00    6253571  2305
sendmail   28   1085.87    0.05      0.24  23865.20  0.00  0.19     101544    39
admintoo    3    397.68    0.12   1132.96  3443.12   0.04  0.00     680220    83 
sh        166    204.78    0.31    161.13  651.80    0.00  0.00     598158    20 
nroff      12    167.17    0.14      0.24  1205.55   0.01  0.59     709048    22 
find       10    151.27    0.27      2.72  563.40    0.03  0.10     877971  1580
acctdusg    3     87.40    0.13      2.74  698.29    0.04  0.05     883845   203 
lp         10     74.29    0.05      0.22  1397.38   0.01  0.24     136460    57 
expr       20     67.48    0.02      0.06  3213.24   0.00  0.34       6380     1 
mail.loc    3     65.83    0.01      0.04  11285.60  0.00  0.15      24709    15
cmdtool     1     37.65    0.02     20.13  2091.56   0.02  0.00     151296     1 
uudemon.  105     37.38    0.09      0.32  435.46    0.00  0.27      62130    17 
csh         6     35.17    0.05     57.28  756.30    0.01  0.00     209560    13 
col        12     31.12    0.06      0.26  523.00    0.00  0.23     309932     0 
ntpdate    22     27.55    0.05     11.18  599.00    0.00  0.00      22419     0 
uuxqt      44     18.66    0.04      0.06  417.79    0.00  0.74      32604     3 
man        12     15.11    0.03      7.05  503.67    0.00  0.00      85266    47
.  
. 
.

The data provided, by column, in the daily command summary is described in the table below.

Table 32-5 Daily Command Summary


Column	Description
`COMMAND NAME`	Name of the command. Unfortunately, all shell procedures are lumped together under the name `sh` because only object modules are reported by the process accounting system. It's a good idea to monitor the frequency of programs called `a.out` or `core` or any other unexpected name. `acctcom` can be used to determine who executed an oddly named command and if superuser privileges were used.
`NUMBER CMNDS`	Total number of invocations of this particular command during prime time.
`TOTAL KCOREMIN`	Total cumulative measurement of the Kbyte segments of memory used by a process per minute of run time.
`TOTAL CPU-MIN:`	Total processing time this program has accumulated during prime time.
`TOTAL REAL-MIN`	Total real-time (wall-clock) minutes this program has accumulated.
`MEAN SIZE-K`	Mean of the `TOTAL` `KCOREMIN` over the number of invocations reflected by `NUMBER` `CMDS`.
`MEAN CPU-MIN`	Mean derived between the `NUMBER` `CMDS` and `TOTAL CPU-MIN`.
`HOG FACTOR`	Total CPU time divided by elapsed time. Shows the ratio of system availability to system use, providing a relative measure of total available CPU time consumed by the process during its execution.
`CHARS TRNSFD`	Total count of the number of characters pushed around by the read and write system calls. May be negative due to overflow.
`BLOCKS READ`	Total count of the physical block reads and writes that a process performed.

Monthly Command Summary

The monthly command summary is similar to the daily command summary. The only difference is that the monthly command summary shows totals accumulated since the last invocation of monacct. A sample report appears below.

Jul  6 02:30:03 1999  MONTHLY TOTAL COMMAND SUMMARY Page 1
 
                                     TOTAL COMMAND SUMMARY
COMMAND NUMBER     TOTAL    TOTAL     TOTAL   MEAN   MEAN   HOG    CHARS  BLOCKS
NAME      CMDS  KCOREMIN   CPU-MIN REAL-MIN SIZE-K CPU-MIN FACTOR TRNSFD   READ
 
TOTALS     771    483.70   0.94    8984.09  515.12   0.00  0.00   2248299   179 
 
sh         105    155.41   0.23     429.58  667.94   0.00  0.00    491870     1 
uudemon.    85     29.39   0.07       0.29  434.28   0.00  0.23     49630    14 
acctcms      5     27.21   0.04       0.04  752.41   0.01  0.90    218880     1 
ntpdate     17     21.30   0.04      14.10  605.73   0.00  0.00     18192     0 
dtpad        1     19.69   0.01      10.87 2072.70   0.01  0.00     46992     8 
sendmail    17     16.75   0.02       0.02  859.04   0.00  0.91     1965      0 
acctprc      1     14.92   0.03       0.03  552.69   0.03  0.95    115584     0 
uuxqt       34     14.78   0.03       0.04  426.29   0.00  0.92     25194     0 
uusched     34     10.96   0.03       0.03  363.25   0.00  0.91     25194     0 
sed         40     10.15   0.03       0.09  315.50   0.00  0.36     64162     2 
man          5     10.08   0.02      57.58  555.05   0.00  0.00     25773     2 
getent       1      7.68   0.01       0.02  921.60   0.01  0.40     20136     0 
in.rlogi     5      7.65   0.01    4331.67  611.73   0.00  0.00     87440     0 
cp          37      7.28   0.03       0.05  280.08   0.00  0.50     1739     36 
date        27      7.24   0.02       0.03  329.12   0.00  0.65     23443     1 
ls          15      7.05   0.01       0.02  503.33   0.00  0.79     14123     0 
awk         19      6.94   0.02       0.06  372.04   0.00  0.32       666     0 
rm          29      6.83   0.02       0.04  301.32   0.00  0.60      2348    17

See "Daily Command Summary " for a description of the data.

Last Login Report

This report gives the date when a particular login was last used. You can use this information to find unused logins and login directories that may be archived and deleted. A sample report appears below.

Jul  7 02:30:03 1999  LAST LOGIN Page 1  
. 
.  
.
00-00-00  arimmer       00-00-00  lister        99-06-27  pjm
00-00-00  reception     00-00-00  smithe        99-06-27  ksm
00-00-00  release       00-00-00  smsc          99-06-27  root
00-00-00  resch         00-00-00  datab

Looking at the `pacct` File With `acctcom`

At any time, you can examine the contents of the /var/adm/pacctn files, or any file with records in the acct.h format, by using the acctcom program. If you don't specify any files and don't provide any standard input when you run this command, acctcom reads the pacct file. Each record read by acctcom represents information about a dead process (active processes may be examined by running the ps command). The default output of acctcom provides the following information:

Command name (pound (#) sign if it was executed with superuser privileges)
User
tty name (listed as ? if unknown)
Starting time
Ending time
Real time (in seconds)
CPU time (in seconds)
Mean size (in Kbytes)

The following information can be obtained by using options to acctcom:

State of the fork/exec flag (1 for fork without exec)
System exit status
Hog factor
Total kcore minutes
CPU factor
Characters transferred
Blocks read

The following table describes the acctcom options.

Table 32-6 acctcom Options


Option	Description
`-a`	Shows some average statistics about the processes selected. (The statistics are printed after the output is recorded.)
`-b`	Reads the files backward, showing latest commands first. (This has no effect if reading standard input.)
`-f`	Prints the `fork/exec` flag and system exit status columns. (The output is an octal number.)
`-h`	Instead of mean memory size, shows the hog factor, which is the fraction of total available CPU time consumed by the process during its execution. Hog factor = total_CPU_time/elapsed_time.
`-i`	Prints columns containing the I/O counts in the output.
`-k`	Shows total `kcore` `minutes` instead of memory size.
`-m`	Shows mean core size (this is the default).
`-q`	Prints average statistics, not output records
`-r`	Shows CPU factor: `user_time`/(`system_time + user_tim`e).
`-t`	Shows separate system and user CPU times.
`-v`	Excludes column headings from the output.
`-C` `sec`	Shows only processes with total CPU time (system plus user) exceeding `sec` seconds.
`-e` `time`	Shows processes existing at or before `time`, given in the format hr[:min[:sec]].
`-E` `time`	Shows processes starting at or before `time`, given in the format hr[:min[:sec]]. Using the same time for both `-S` and `-E`, show processes that existed at the time.
`-g` `group`	Shows only processes belonging to `group`.
`-H` `factor`	Shows only processes that exceed `factor`, where `factor` is the "hog factor" (see the `-h` option).
`-I` `chars`	Shows only processes transferring more characters than the cutoff number specified by `chars`.
`-l` `line`	Show only processes belonging to the terminal `/dev/line`.
`-n` `pattern`	Shows only commands matching `pattern` (a regular expression except that "`+`" means one or more occurrences).
`-o` `ofile`	Instead of printing the records, copys them in `acct.h` format to `ofile`.
`-O` `sec`	Shows only processes with CPU system time exceeding `sec` seconds.
`-s` `time`	Show processes existing at or after `time`, given in the format `hr`[:`min`[:`sec`]].
`-S` `time`	Show processes starting at or after `time`, given in the format `hr`[:`min`[:`sec`]].
`-u` `user`	Shows only processes belonging to `user`.

The `runacct` Program

The main daily accounting shell script, runacct, is normally invoked by cron outside of prime business hours. The runacct shell script processes connect, fee, disk, and process accounting files. It also prepares daily and cumulative summary files for use by prdaily and monacct for billing purposes.

The runacct shell script takes care not to damage files if errors occur. A series of protection mechanisms are used that attempt to recognize an error, provide intelligent diagnostics, and complete processing in such a way that runacct can be restarted with minimal intervention. It records its progress by writing descriptive messages into the file active. (Files used by runacct are assumed to be in the /var/adm/acct/nite directory, unless otherwise noted.) All diagnostic output during the execution of runacct is written into fd2log.

When runacct is invoked, it creates the files lock and lock1. These files are used to prevent simultaneous execution of runacct. The runacct program prints an error message if these files exist when it is invoked. The lastdate file contains the month and day runacct was last invoked, and is used to prevent more than one execution per day. If runacct detects an error, a message is written to the console, mail is sent to root and adm, locks may be removed, diagnostic files are saved, and execution is ended. For instructions on how to start runacct again, see "How to Restart runacct".

To allow runacct to be restartable, processing is broken down into separate re-entrant states. The file statefile is used to keep track of the last state completed. When each state is completed, statefile is updated to reflect the next state. After processing for the state is complete, statefile is read and the next state is processed. When runacct reaches the CLEANUP state, it removes the locks and ends. States are executed as shown in the table below.

Table 32-7 runacct States


State	Description
`SETUP`	The command `turnacct` `switch` is executed to create a new `pacct` file. The process accounting files in `/var/adm/pacctn` (except for the `pacct` file) are moved to `/var/adm/Spacctn.MMDD`. The `/var/adm/wtmpx` file is moved to `/var/adm/acct/nite/wtmp.MMDD` (with the current time record added on the end) and a new `/var/adm/wtmp` is created. `closewtmp` and `utmp2wtmp` add records to `wtmp`.`MMDD` and the new `wtmpx` to account for users currently logged in.
`WTMPFIX`	The `wtmpfix` program checks the `wtmp.MMDD` file in the `nite` directory for accuracy. Because some date changes will cause `acctcon` to fail, `wtmpfix` attempts to adjust the time stamps in the `wtmpx` file if a record of a date change appears. It also deletes any corrupted entries from the `wtmpx` file. The fixed version of `wtmp.MMDD` is written to `tmpwtmp`.
`CONNECT`	The `acctcon` program is used to record connect accounting records in the file `ctacct.MMDD`. These records are in `tacct.h` format. In addition, `acctcon` creates the `lineuse` and `reboots` files. The `reboots` file records all the boot records found in the `wtmpx` file.
`PROCESS`	The `acctprc` program is used to convert the process accounting files, `/var/adm/Spacctn.MMDD`, into total accounting records in `ptacctn.MMDD`. The `Spacct` and `ptacct` files are correlated by number so that if `runacct` fails, the `Spacct` files will not be processed.
`MERGE`	The `acctmerg` program merges the process accounting records with the connect accounting records to form `daytacct`.
`FEES`	The `acctmerg` program merges ASCII `tacct` records from the `fee` file into `daytacct`.
`DISK`	If the `dodisk` procedure has been run, producing the `disktacct` file, the `DISK` program merges the file into `daytacct` and moves `disktacct` to `/tmp/disktacct.MMDD`.
`MERGETACCT`	The `acctmerg` program merges `daytacct` with `sum/tacct`, the cumulative total accounting file. Each day, `daytacct` is saved in `sum/tacct.MMDD`, so that `sum/tacct` can be recreated if it is corrupted or lost.
`CMS`	The `acctcms` program is run several times. `acctcms` is first run to generate the command summary using the `Spacctn` files and write it to `sum/daycms`. The `acctcms` program is then run to merge `sum/daycms` with the cumulative command summary file `sum/cms`. Finally, `acctcms` is run to produce the ASCII command summary files, `nite/daycms` and `nite/cms`, from the `sum/daycms` and `sum/cms` files, respectively. The `lastlogin` program is used to create the `/var/adm/acct/sum/loginlog` log file, the report of when each user last logged in. (If `runacct` is run after midnight, the dates showing the time last logged in by some users will be incorrect by one day.)
`USEREXIT`	Any installation-dependent (local) accounting program can be included at this point. `runacct` expects it to be called `/usr/lib/acct/runacct.local`.
`CLEANUP`	Cleans up temporary files, runs `prdaily` and saves its output in `sum/rpt.MMDD`, removes the locks, then exits.

Caution -

When restarting runacct in the CLEANUP state, remove the last ptacct file because it will not be complete.

Accounting Files

The /var/adm directory structure contains the active data collection files.

The following table describes the accounting related files in the /var/adm directory.

Table 32-8 Files in the /var/adm Directory


File	Description
`dtmp`	Output from the `acctdusg` program
`fee`	Output from the `chargefee` program, ASCII `tacct` records
`pacct`	Active process accounting file
`pacctn`	Process accounting files switched using `turnacct`
`Spacctn`.`MMDD`	Process accounting files for `MMDD` during execution of `runacct`

The /var/adm/acct directory contains the nite, sum, and fiscal directories, which contain the actual data collection files. For example, the nite directory contains files that are reused daily by the runacct procedure. A brief summary of the files in the /var/adm/acct/nite directory follows.

Table 32-9 Files in the /var/adm/acct/nite Directory


File	Description
`active`	Used by `runacct` to record progress and print warning and error messages
`activeMMDD`	Same as `active` after `runacct` detects an error
`cms`	ASCII total command summary used by `prdaily`
`ctacct.MMDD`	Connect accounting records in `tacct.h` format
`ctmp`	Output of `acctcon1` program, connect session records in `ctmp.h` format (`acctcon1` and `acctcon2` are provided for compatibility purposes)
`daycms`	ASCII daily command summary used by `prdaily`
`daytacct`	Total accounting records for one day in `tacct.h` format
`disktacct`	Disk accounting records in `tacct.h` format, created by the `dodisk` procedure
`fd2log`	Diagnostic output during execution of `runacct`
`lastdate`	Last day `runacct` executed (in `date +%m%d` format)
`lock`	Used to control serial use of `runacct`
`lineuse`	`tty` line usage report used by `prdaily`
`log`	Diagnostic output from `acctcon`
`log.MMDD`	Same as `log` after `runacct` detects an error
`owtmp`	Previous day's `wtmpx` file
`reboots`	Beginning and ending dates from `wtmpx` and a listing of reboots
`statefile`	Used to record current state during execution of `runacct`
`tmpwtmp`	`wtmpx` file corrected by `wtmpfix`
`wtmperror`	Place for `wtmpfix` error messages
`wtmperror`.`MMDD`	Same as `wtmperror` after `runacct` detects an error
`wtmp.MMDD`	`runacct`'s copy of the `wtmpx` file

The sum directory contains the cumulative summary files updated by runacct and used by monacct. A brief summary of the files in the /var/adm/acct/sum directory is shown in the following table.

Table 32-10 Files in the /var/adm/acct/sum Directory


File	Description
`cms`	Total command summary file for current fiscal period in internal summary format
`cmsprev`	Command summary file without latest update
`daycms`	Command summary file for the day's usage in internal summary format
`loginlog`	Record of last date each user logged on; created by `lastlogin` and used in the `prdaily` program
`rprt.MMDD`	Saved output of `prdaily` program
`tacct`	Cumulative total accounting file for current fiscal period
`tacctprev`	Same as `tacct` without latest update
`tacct.MMDD`	Total accounting file for `MMDD`

The fiscal directory contains periodic summary files created by monacct. A brief description of the files in the /var/adm/acct/fiscal directory is shown in the following table.

Table 32-11 Files in the /var/adm/acct/fiscal Directory


File	Description
`cmsn`	Total command summary file for fiscal period `n` in internal summary format
`fiscrptn`	Report similar to `rprtn` for fiscal period `n`
`tacctn`	Total accounting file for fiscal period `n`

Files Produced by `runacct`

The most useful files produced by runacct (found in /var/adm/acct) are shown in the following table.

Table 32-12 Files Produced by runacct


File	Description
`nite/lineuse`	`runacct` calls `acctcon` to gather data on terminal line usage from `/var/adm/acct/nite/tmpwtmp` and writes the data to `/var/adm/acct/nite/lineuse`. `prdaily` uses this data to report line usage. This report is especially useful for detecting bad lines. If the ratio between the number of logouts to logins is greater than about three to one, there is a good possibility that the line is failing.
`nite/daytacct`	This file is the total accounting file for the day in `tacct.h` format.
`sum/tacct`	This file is the accumulation of each day's `nite/daytacct` and can be used for billing purposes. It is restarted each month or fiscal period by the `monacct` procedure.
`sum/daycms`	`runacct` calls `acctcms` to process the data about the commands used during the day. This information is stored in `/var/adm/acct/sum/daycms`. It contains the daily command summary. The ASCII version of this file is `/var/adm/acct/nite/daycms`.
`sum/cms`	This file is the accumulation of each day's command summaries. It is restarted by the execution of `monacct`. The ASCII version is `nite/cms`.
`sum/loginlog`	`runacct` calls `lastlogin` to update the last date logged in for the logins in `/var/adm/acct/sum/loginlog`. `lastlogin` also removes from this file logins that are no longer valid.
`sum/rprt.MMDD`	Each execution of `runacct` saves a copy of the daily report that was printed by `prdaily`.