Here is a step-by-step summary of how daily accounting works:
When the system is switched into multiuser mode, the /usr/lib/acct/startup program is executed. The startup program executes several other programs that invoke accounting.
The acctwtmp program adds a "boot" record to /var/adm/wtmpx. In this record, the system name is shown as the login name in the wtmpx record. The following table summarizes how the raw accounting data is gathered and where it is stored.
Table 32-1 Raw Accounting Data
The turnacct program, invoked with the -on option, begins process accounting. Specifically, turnacct executes the accton program with the /var/adm/pacct argument.
The remove shell script "cleans up" the saved pacct and wtmpx files left in the sum directory by runacct.
The login and init programs record connect sessions by writing records into /var/adm/wtmpx. Any date changes (using date with an argument) are also written to /var/adm/wtmpx. Reboots and shutdowns using acctwtmp are also recorded in /var/adm/wtmpx.
When a process ends, the kernel writes one record per process, using acct.h format, in the /var/adm/pacct file.
Every hour, cron executes the ckpacct program to check the size of /var/adm/pacct. If the file grows past 500 blocks (default), the turnacct switch is executed. (The program moves the pacct file and creates a new one.) The advantage of having several smaller pacct files becomes apparent when trying to restart runacct if a failure occurs when processing these records.
runacct is executed by cron each night. runacct processes the accounting files: /var/adm/pacctn, /var/adm/wtmpx, /var/adm/fee, and /var/adm/acct/nite/disktacct, to produce command summaries and usage summaries by login.
The /usr/lib/acct/prdaily program is executed on a daily basis by runacct to write the daily accounting information collected by runacct (in ASCII format) in /var/adm/acct/sum/rprt.MMDD.
The monacct program should be executed on a monthly basis (or at intervals determined by you, such as the end of every fiscal period). The monacct program creates a report based on data stored in the sum directory that has been updated daily by runacct. After creating the report, monacct "cleans up" the sum directory to prepare the directory's files for the new runacct data.
If the system is shut down using shutdown, the shutacct program is executed automatically. The shutacct program writes a reason record into /var/adm/wtmpx and turns off process accounting.