Maintaining Accounting Information

This section describes how to maintain accounting information.

Fixing Corrupted Files and wtmp Errors

Unfortunately, the UNIX accounting system is not foolproof. Occasionally, a file will become corrupted or lost. Some of the files can simply be ignored or restored from backup. However, certain files must be fixed to maintain the integrity of the accounting system.

The wtmp files seem to cause the most problems in the day-to-day operation of the accounting system. When the date is changed and the system is in multiuser mode, a set of date change records is written into /var/adm/wtmp. The wtmpfix utility is designed to adjust the time stamps in the wtmp records when a date change is encountered. However, some combinations of date changes and reboots will slip through wtmpfix and cause acctcon to fail. For instructions on correcting wtmp problems, see "How to Fix a wtmp File".

How to Fix a wtmp File

1. Become superuser.

2. Change to the /var/adm/acct/nite directory.

3. Convert the binary file wtmp.MMDD into the ASCII file xwtmp.

   # fwtmp wtmp.MMDD xwtmp

   MMDD	Pair of two-digit numbers representing the month and day.

4. Edit xwtmp. Delete the corrupted files, or delete all records from the beginning up to the date change.

5. Convert the ASCII file xwtmp to a binary file, overwriting the corrupted file.

   # fwtmp -ic xwtmp wtmp.MMDD

Fixing tacct Errors

The integrity of /var/adm/acct/sum/tacct is important if you are charging users for system resources. Occasionally, mysterious tacct records appear with negative numbers, duplicate user IDs, or a user ID of 65535. First, check /var/adm/acct/sum/tacctprev, using prtacct to print it. If the contents look all right, patch the latest /var/adm/acct/sum/tacct.MMDD file, then recreate the /var/adm/acct/sum/tacct file. The following steps outline a simple patch procedure.

How to Fix tacct Errors

1. Become superuser.

2. Change to the /var/adm/acct/sum directory.

3. Convert the contents of tacct.MMDD from binary to ASCII format.

   # acctmerg -v tacct.MMDD xtacct

   MMDD	Month and day specified by two-digit numbers.

4. Edit the xtacct file, removing bad records and writing duplicate records to another file.

5. Convert the xtacct file from ASCII format to binary.

   # acctmerg -i xtacct tacct.MMDD

   MMDD	Month and day specified by two-digit numbers.

6. Merge the files tacct.prv and tacct.MMDD into the file tacct.

   # acctmerg tacctprv tacct.MMDD tacct

Restarting runacct

The runacct program can fail for a variety of reasons, the most common being a system crash, /var running out of space, or a corrupted wtmp file. If the activeMMDD file exists, check it first for error messages. If the active and lock files exist, check fd2log for any mysterious messages.

Called without arguments, runacct assumes that this is the first invocation of the day. The argument MMDD is necessary if runacct is being restarted and specifies the month and day for which runacct will rerun the accounting. The entry point for processing is based on the contents of statefile. To override statefile, include the desired state on the command line.

When running the runacct program manually, be sure to run it as user adm.

How to Restart runacct

1. Remove the lastdate file and any lock* files, if any.

   $ cd /var/adm/acct/nite $ rm lastdate lock*

2. Restart the runacct program.

   $ runacct MMDD [state] 2> /var/adm/acct/nite/fd2log &

   MMDD	Month and day specified by two-digit numbers.
   state	Specifies a state, or starting point, where runacct processing should begin.