[ Next Article | Previous Article | Book Contents | Library Home | Legal | Search ]
System Management Concepts: Operating System and Devices

Accounting Overview

The accounting system utility allows you to collect and report on individual and group use of various system resources.

This accounting information can be used to bill users for the system resources they utilize, and to monitor selected aspects of the system's operation. To assist with billing, the accounting system provides the resource-usage totals defined by members of the adm group, and, if the chargefee command is included, factors in the billing fee.

The accounting system also provides data to assess the adequacy of current resource assignments, set resource limits and quotas, forecast future needs, and order supplies for printers and other devices.

The following information should help you understand how to implement the accounting utility in your system:

Collecting and Reporting System Data

For data to be collected automatically, a member of the adm group needs to follow the procedures described in "Setting Up an Accounting System" . These procedures enable the cron daemon to run the commands that generate data on:

The system writes a record of each session and process after they are completed. These records are converted into total accounting (tacct) records arranged by user and merged into a daily report. Periodically, the daily reports are combined to produce totals for the defined fiscal period. Methods for collecting and reporting the data and the various accounting commands and files are discussed in the following sections.

Although most of the accounting data is collected and processed automatically, a member of the adm group can enter certain commands from the keyboard to obtain specific information. These commands are discussed in "Keyboard Commands" .

Collecting Accounting Data

There are several types of accounting data: connect-time data, process data, disk-usage data, printer-usage data, and fee data. Each is described in the following paragraphs.

Connect-Time Accounting

Connect-time data is collected by the init command and the login command. When you log in, the login program writes a record in the /etc/utmp file. This record includes your user name, the date and time of the login, and the login port. Commands, such as who, use this file to find out which users are logged into the various display stations. If the /var/adm/wtmp connect-time accounting file exists, the login command adds a copy of this login record to it.

When your login program ends (normally when you log out), the init command records the end of the session by writing another record in the /var/adm/wtmp file. Logout records differ from login records in that they have a blank user name. Both the login and logout records have the form described in the utmp.h file.

The acctwtmp command also writes special entries in the /var/adm/wtmp file concerning system shutdowns and startups.

For more information, see "Connect-Time Reports" .

Process Accounting

The system collects data on resource usage for each process as it runs. These data include:

The accton command records these data in a specified file, usually the /var/adm/pacct file.

Related commands are the startup command, the shutacct command, the dodisk command, the ckpacct command, and the turnacct command.

For more information, see "Reporting Accounting Data" .

Disk-Usage Accounting

Much accounting information is collected as the resources are consumed. The dodisk command, run as specified by the cron daemon, periodically writes disk-usage records for each user to the /var/adm/acct/nite/dacct file. To accomplish this, the dodisk command calls other commands. Depending upon the thoroughness of the accounting search, the diskusg command or the acctdusg command can be used to collect data. The acctdisk command is used to write a total accounting record. The total accounting record, in turn, is used by the acctmerg command to prepare the daily accounting report.

The dodisk command charges a user for the links to files found in the user's login directory and evenly divides the charge for each file between the links. This spreads the cost of using a file over all who use it and removes the charges from users when they relinquish access to a file.

For more information, see "Disk-Usage Accounting Report" .

Printer-Usage Accounting

The collection of printer-usage data is a cooperative effort between the enq command and the queuing daemon. The enq command enqueues the user name, job number, and the name of the file to be printed. After the file is printed, the qdaemon command writes an ASCII record to a file, usually the /var/adm/qacct file, containing the user name, user number, and the number of pages printed. You can sort these records and convert them to total accounting records.

For more information, see "Printer-Usage Accounting Report" .

Fee Accounting

You can enter the chargefee command to produce an ASCII total accounting record in the /var/adm/fee file. This file will be added to daily reports by the acctmerg command.

For more information, see "Fee Accounting Report" .

Reporting Accounting Data

After the various types of accounting data are collected, the records are processed and converted into reports.

Accounting commands automatically convert records into scientific notation when numbers become large. A number is represented in scientific notation in the following format:

Basee+Exp

OR

Basee-Exp

which is the number equal to the Base number multiplied by 10 to the +Exp or -Exp power. For example, the scientific notation 1.345e+9 is equal to 1.345x109, or 1,345,000,000. And the scientific notation 1.345e-9 is equal to 1.345x10-9 or, .000000001345.

Connect-Time Reports

The runacct command calls two commands, acctcon1 and acctcon2, to process the login, logout, and system-shutdown records that collect in the /var/adm/wtmp file. The acctcon1 command converts these records into session records and writes them to the /var/adm/acct/nite/lineuse file. The acctcon2 command then converts the session records into a total accounting record, /var/adm/logacct, that the acctmerg command adds to daily reports.

If you run the acctcon1 command from the command line, you must include the -l flag to produce the line-use report, /var/adm/acct/nite/lineuse. To produce an overall session report for the accounting period, /var/adm/acct/nite/reboots, use the acctcon1 command with the -o flag.

The lastlogin command produces a report that gives the last date on which each user logged in.

Process Accounting Reports

Two commands process the billing-related data that was collected in the /var/adm/pacct or other specified file. The acctprc1 command translates the user ID into a user name and writes ASCII records containing the chargeable items (prime and non-prime CPU time, mean memory size, and I/O data). The acctprc2 command transforms these records into total accounting records that are added to daily reports by the acctmerg command.

Process accounting data also provides information that you can use to monitor system resource usage. The acctcms command summarizes resource use by command name. This provides information on how many times each command was run, how much processor time and memory was used, and how intensely the resources were used (also known as the hog factor). The acctcms command produces long-term statistics on system utilization, providing information on total system usage and the frequency with which commands are used.

The acctcom command handles the same data as the acctcms command, but provides detailed information about each process. You can display all process accounting records or select records of particular interest. Selection criteria include the load imposed by the process, the time period when the process ended, the name of the command, the user or group that invoked the process, and the port at which the process ran. Unlike other accounting commands, acctcom can be run by all users.

Disk-Usage Accounting Report

The disk-usage records collected in the /var/adm/acct/nite/dacct file are merged into the daily accounting reports by the acctmerg command.

Printer-Usage Accounting Report

The ASCII record in the /var/adm/qacct file can be converted to a total accounting record to be added to the daily report by the acctmerg command.

Fee Accounting Report

If you used the chargefee command to charge users for services such as file restores, consulting, or materials, an ASCII total accounting record is written in the /var/adm/fee file. This file is added to the daily reports by the acctmerg command.

Daily Reports

Raw accounting data on connect-time, processes, disk usage, printer usage, and fees to charge are merged into daily reports by the acctmerg command. Called by the runacct command as part of its daily operation, the acctmerg command produces the following:

/var/adm/acct/nite/dacct An intermediate report that is produced when one of the input files is full.
/var/adm/acct/sum/tacct A cumulative total report in tacct format. This file is used by the monacct command to produce the ASCII monthly summary.

The acctmerg command can convert records between ASCII and binary formats and merge records from different sources into a single record for each user.

Monthly Report

Called by the cron daemon, the monacct command produces the following:

/var/adm/acct/fiscal A periodic summary report produced from the /var/adm/acct/sum/tacct report by the monacct command. The monacct command can be configured to run monthly or at the end of a fiscal period.

Accounting Commands

The accounting commands function several different ways. Some commands:

Commands That Run Automatically

Several commands usually run by the cron daemon automatically collect accounting data.

runacct
                            Handles the main daily accounting procedure. Normally initiated by the cron daemon during non-prime hours, the runacct command calls several other accounting commands to process the active data files and produce command and resource usage summaries, sorted by user name. It also calls the acctmerg command to produce daily summary report files, and the ckpacct command to maintain the integrity of the active data files.
ckpacct
                            Handles pacct file size. It is advantageous to have several smaller pacct files if you must restart the runacct procedure after a failure in processing these records. The ckpacct command checks the size of the /var/adm/pacct active data file, and if the file is larger than 500 blocks, the command invokes the turnacct switch command to turn off process accounting temporarily. The data is transferred to a new pacct file, /var/adm/pacct x. (x is an integer that increases each time a new pacct file is created.) If the number of free disk blocks falls below 500, the ckpacct command calls the turnacct off command to turn off process accounting.
dodisk
                            Calls the acctdisk command and either the diskusg command or the acctdusg command to write disk-usage records to the /var/adm/acct/nite/dacct file. This data is later merged into the daily reports.
monacct
                            Produces a periodic summary from daily reports.
sa1
                            Collects and stores binary data in the /var/adm/sa/sa dd file, where dd is the day of the month.
sa2
                            Writes a daily report in the /var/adm/sa/sadd file, where dd is the day of the month. The command removes reports from the /var/adm/sa/sadd file that have been there longer than one week.

Other commands are run automatically by procedures other than the cron daemon:

startup
                            When added to the /etc/rc file, the startup command initiates startup procedures for the accounting system.
shutacct
                            Records the time accounting was turned off by calling the acctwtmp command to write a line to /var/adm/wtmp file. It then calls the turnacct off command to turn off process accounting.

Keyboard Commands

A member of the adm group can enter the following commands from the keyboard:

ac
                            Prints connect-time records. This command is provided for compatibility with Berkeley Software Distribution (BSD) systems.
acctcom
                            Displays process accounting summaries. This command is also available to users.
acctcon1
                            Displays connect-time summaries. Either the -l flag or the -o flag must be used.
accton
                            Turns process accounting on and off.
chargefee
                            Charges the user a predetermined fee for units of work performed. The charges are added to the daily report by the acctmerg command.
fwtmp
                            Converts files between binary and ASCII formats.
last
                            Displays information about previous logins. This command is provided for compatibility with Berkeley Software Distribution (BSD) systems.
lastcomm
                            Displays information about the last commands that were executed. This command is provided for compatibility with Berkeley Software Distribution (BSD) systems.
lastlogin
                            Displays the time each user last logged in.
pac
                            Prepares printer/plotter accounting records. This command is provided for compatibility with Berkeley Software Distribution (BSD) systems.
prctmp
                            Displays a session record.
prtacct
                            Displays total accounting files.
sa
                            Summarizes raw accounting information to help manage large volumes of accounting information. This command is provided for compatibility with Berkeley Software Distribution (BSD) systems.
sadc
                            Reports on various local system actions, such as buffer usage, disk and tape I/O activity, TTY device activity counters, and file access counters.
time
                            Prints real time, user time, and system time required to execute a command.
timex
                            Reports in seconds the elapsed time, user time, and execution time.
sar
                            Writes to standard output the contents of selected cumulative activity counters in the operating system. The sar command reports only on local activities.

Accounting Files

There are two main accounting directories: the /usr/sbin/acct directory, where all the C language programs and shell procedures needed to run the accounting system are stored, and the /var/adm directory, which contains the data, report and summary files.

The accounting data files belong to members of the adm group, and all active data files (such as wtmp and pacct) reside in the adm home directory /var/adm.

Data Files

Files in the /var/adm directory are:

/var/adm/diskdiag Diagnostic output during the execution of disk accounting programs.
/var/adm/dtmp Output from the acctdusg command.
/var/adm/fee Output from the chargefee command, in ASCII tacct records.
/var/adm/pacct Active process accounting file.
/var/adm/wtmp Active process accounting file.
/var/adm/Spacct .mmdd Process accounting files for mmdd during the execution of the runacct command.

Report and Summary Files

Report and summary files reside in a /var/adm/acct subdirectory. You must create the following subdirectories before the accounting system is enabled. See "Setting Up an Accounting System" for more information.

/var/adm/acct/nite Contains files that the runacct command reuses daily.
/var/adm/acct/sum Contains the cumulative summary files that the runacct command updates daily.
/var/adm/acct/fiscal Contains the monthly summary files that the monacct command creates.

runacct Command Files

The following report and summary files, produced by the runacct command, are of particular interest:

/var/adm/acct/nite/lineuse Contains usage statistics for each terminal line on the system. This report is especially useful for detecting bad lines. If the ratio between the number of logouts and logins exceeds about 3 to 1, there is a good possibility that a line is failing.
/var/adm/acct/nite/daytacct Contains the total accounting file for the previous day.
/var/adm/acct/sum/tacct Contains the accumulation of each day's nite/daytacct file and can be used for billing purposes. The monacct command restarts the file each month or fiscal period.
/var/adm/acct/sum/cms Contains the accumulation of each day's command summaries. The monacct command reads this binary version of the file and purges it. The ASCII version is nite/cms.
/var/adm/acct/sum/daycms Contains the daily command summary. An ASCII version is stored in nite/daycms.
/var/adm/acct/sum/loginlog Contains a record of the last time each user ID was used.
/var/adm/acct/sum/rprt mmdd This file contains a copy of the daily report saved by the runacct command.

Files in the /var/adm/acct/nite Directory

active Used by the runacct command to record progress and print warning and error messages. The file active. mmdd is a copy of the active file made by the runacct program after it detects an error.
cms ASCII total command summary used by the prdaily command.
ctacct.mmdd Connect total accounting records.
ctmp Connect session records.
daycms ASCII daily command summary used by the prdaily command.
daytacct Total accounting records for one day.
dacct Disk total accounting records, created by the dodisk command.
accterr Diagnostic output produced during the execution of the runacct command.
lastdate Last day the runacct executed, in date +%m%d format.
lock1 Used to control serial use of the runacct command.
lineuse tty line usage report used by the prdaily command.
log Diagnostic output from the acctcon1 command.
logmmdd Same as log after the runacct command detects an error.
reboots Contains beginning and ending dates from wtmp, and a listing of system restarts.
statefile Used to record the current state during execution of the runacct command.
tmpwtmp wtmp file corrected by the wtmpfix command.
wtmperror Contains wtmpfix error messages.
wtmperrmmdd Same as wtmperror after the runacct command detects an error.
wtmp.mmdd Previous day's wtmp file.

Files in the /var/adm/acct/sum Directory

cms Total command summary file for the current fiscal period, in binary format.
cmsprev Command summary file without the latest update.
daycms Command summary file for the previous day, in binary format.
lastlogin File created by the lastlogin command.
pacct.mmdd Concatenated version of all pacct files for mmdd. This file is removed after system startup by the remove command.
rprtmmdd Saved output of the prdaily command.
tacct Cumulative total accounting file for the current fiscal period.
tacctprev Same as tacct without the latest update.
tacctmmdd Total accounting file for mmdd.
wtmp.mmdd Saved copy of the wtmp file for mmdd. This file is removed after system startup by the remove command.

Files in the /var/adm/acct/fiscal Directory

cms? Total command summary file for the fiscal period, specified by ?, in binary format.
fiscrpt? A report similar to that of the prdaily command for fiscal period, specified by ?, in binary format.
tacct? Total accounting file for fiscal period, specified by ?, in binary format.

Accounting File Formats

Accounting file output and formats are summarized in the following.

wtmp Produces the active process accounting file. The format of the wtmp file is defined in the utmp.h file.
ctmp Produces connect session records. The format is described in the ctmp.h file.
pacct* Produces active process accounting records. The format of the output is defined in the /usr/include/sys/acct.h file.
Spacct* Produces process accounting files for mmdd during the execution of the runacct command. The format of these files is defined in the sys/acct.h file.
daytacct Produces total accounting records for one day. The format of the file is defined in the tacct file format.
sum/tacct Produces binary file that accumulates each day's command summaries. The format of this file is defined in the /usr/include/sys/acct.h header file.
ptacct Produces concatenated versions of pacct files. The format of these files are defined in the tacct file.
ctacct Produces connect total accounting records. The output of this file is defined in the tacct file.
cms Produces total accounting command summary used by the prdaily command, in binary format. The ASCII version is nite/cms.
daycms Daily command summary used by the prdaily command, in binary format. The ASCII version is nite/daycms.

[ Next Article | Previous Article | Book Contents | Library Home | Legal | Search ]