How Daily Accounting Works

Here is a step-by-step summary of how daily accounting works:

1. When the system is switched into multiuser mode, the /usr/lib/acct/startup program is executed. The startup program executes several other programs that invoke accounting.

2. The acctwtmp program adds a "boot" record to /var/adm/wtmp. In this record, the system name is shown as the login name in the wtmp record. Table 61-1 summarizes how the raw accounting data is gathered and where it is stored.

   Table 61-1 Raw Accounting Data

   File in /var/adm	Information	Written By	Format
   wtmp	Connect sessions	login, init	utmp.h
   	Changes	date
   	Reboots	acctwtmp
   	Shutdowns	shutacct shell
   pacctn	Processes	Kernel (when the process ends)	acct.h
   		turnacct switch (creates a new file when the old one reaches 500 blocks)
   fee	Special charges	chargefee	acct.h
   acct/nite/disktacct	Disk space used	dodisk	tacct.h

3. The turnacct program, invoked with the -on option, begins process accounting. Specifically, turnacct executes the accton program with the /var/adm/pacct argument.

4. The remove shell script "cleans up" the saved pacct and wtmp files left in the sum directory by runacct.

5. The login and init programs record connect sessions by writing records into /var/adm/wtmp. Any date changes (using date with an argument) are also written to /var/adm/wtmp. Reboots and shutdowns using acctwtmp are also recorded in /var/adm/wtmp.

6. When a process ends, the kernel writes one record per process, using acct.h format, in the /var/adm/pacct file.

   Every hour, cron executes the ckpacct program to check the size of /var/adm/pacct. If the file grows past 500 blocks (default), the turnacct switch is executed. (The program moves the pacct file and creates a new one.) The advantage of having several smaller pacct files becomes apparent when trying to restart runacct if a failure occurs when processing these records.

7. runacct is executed by cron each night. runacct processes the accounting files: /var/adm/pacctn, /var/adm/wtmp, /var/adm/fee, and /var/adm/acct/nite/disktacct, to produce command summaries and usage summaries by login.

8. The /usr/lib/acct/prdaily program is executed on a daily basis by runacct to write the daily accounting information collected by runacct (in ASCII format) in /var/adm/acct/sum/rprt.MMDD.

9. The monacct program should be executed on a monthly basis (or at intervals determined by you, such as the end of every fiscal period). The monacct program creates a report based on data stored in the sum directory that has been updated daily by runacct. After creating the report, monacct "cleans up" the sum directory to prepare the directory's files for the new runacct data.

What Happens if the System Shuts Down

If the system is shut down using shutdown, the shutacct program is executed automatically. The shutacct program writes a reason record into /var/adm/wtmp and turns off process accounting.