UNIX Unleashed, System Administrator's Edition - 21 - UNIX System Accounting The UNIX accounting system collects information on individual and group usage of the computer system resources. You may use this information as an accounting charge back system to bill users for the system resources utilized during a prescribed billing cycle. Accounting reports generated by the system accounting utilities provide information the systems administrator may use to assess current resource assignments, set resource limits and quotas, and forecast future resource requirements. This chapter will cover: UNIX System Accounting basics Command definitions Configuration examples IBM AIX 4.2 Accounting Procedures HP-UX 10.x Accounting Procedures Solaris 2.5 Accounting Procedures System Accounting Directory Structure System Accounting Report Generation UNIX System Accounting Basics Once the computer system has been initialized, and assuming the system accounting option is enabled, statistical collection begins. The data collection process encompasses the following categories: Connect session statistics Process usage Disk space utilization Printer usage The accounting system process begins by gathering statistical data from which summary reports can be generated. These reports may be used to assist in system performance analysis and provide the criteria necessary to establish an equitable customer charge back billing system. The aforementioned report categories include several types of reporting data that is collected to make up the accounting reports. Each category is described in the following sections. Connect Session Statistics The business units responsible for the organization's information technology (IT) services may use connect session statistics to charge customers for the time spent using system resources. This allows an organization to bill or charge back based on a user's actual connect time. Connect-session accounting data, related to user login and logout, is collected by the init and login commands. When a user logs in, the login program makes an entry in the /var/adm/wtmp file. These records maintain the following user information: User name Date of login/logout Time of login/logout Terminal port This information can be used to produce reports containing the following information: Date and starting time of connect session User ID for the connect session Login name Number of prime connect time seconds used Number of nonprime connect time seconds used Connect time seconds used Device address of connect session Number of seconds elapsed from Jan 1 1970 to connect session starting time Process Usage System accounting also gathers statistics by individual processes. Examples of collected statistics include: Memory usage User and group numbers under which the process runs First eight characters of the name of the command Elapsed time and processor time used by the process I/O statistics Number of characters transferred Number of disk blocks read or written on behalf of the process The statistical information is maintained in the accounting file /var/adm/pacct. This file is accessed by many of the accounting commands used with system accounting. After a process terminates, the kernel writes process specific information to the /var/adm/pacct file. This file contains: Process owner's user ID Command used to start the process Process execution time System accounting provides commands to display, report, and summarize process information. Commands also exist (for example, the ckpacct command) to ensure that the process accounting file (/var/adm/pacct) does not grow beyond a specific size. Disk Space Utilization System accounting provides the ability for the systems administrator to monitor disk utilization by users. To restrict users to a specified disk usage limit, the systems administrator may implement a disk quota system. As a note, systems administrators should be aware that users can evade charges and quota restrictions for disk usage by changing the ownership of their files to that of another user. This allows an unsuspecting user to be charged fees that are rightfully someone else's. Disk usage commands perform three basic functions: Collect disk usage by filesystem Report disk usage by user Gather disk statistics and maintain them in a format that may be used by other system accounting commands for further reporting. Printer Usage (AIX 4.2) Printer usage data is stored in the /var/adm/qacct file in ASCII format. The qdaemon will write the ASCII data to the /var/adm/qacct file after a print job is completed. The record of data stored for each printer queue contains the following data: User Name User number(UID) Number of pages printed Command Definitions UNIX systems accounting supports numerous commands that can be run via cron and/or the command line. The following discusses some of these commands and the suggested execution method. Commands That Run Automatically There are several command entries that the systems administrator must install in the crontab file /var/spool/cron/crontabs/adm to begin collecting accounting data. This is the cron file for the adm user who owns all the accounting files and processes. These commands are intended to be executed by cron in a batch mode, but can be manually executed from the command line. runacct Maintains the daily accounting procedures. This command works with the acctmerg command to produce the daily summary report files sorted by user name. ckpacct Controls the size of the /var/adm/pacct file. When the /var/adm/pacct file grows larger than a specified number of blocks (default = 1000 blocks), it turns off accounting and moves the file off to a location equal to /var/adm/pacctx (x is the number of the file). Then ckpacct creates a new /var/adm/pacct for statistic storage. When the amount of free space on the filesystem falls below a designated threshold (default = 500 blocks), ckpacct automatically turns off process accounting. Once the free space exceeds the threshold, ckpacct restarts process accounting. dodisk Dodisk produces disk usage accounting records by using the diskusg, acctdusg, and acctdisk commands. In the default case, dodisk creates disk accounting records on the special files. These special filenames are maintained in /etc/fstab for HP-UX 10.x and /etc/filesystems for AIX 4.2.x. monacct Uses the daily reports created by the commands above to produce monthly summary reports. sa1 System accounting data is collected and maintained in binary format in the file /var/adm/sa/sa{dd}, where {dd} is the day of the month. sa2 This command removes reports from the /var/adm/sa/sa{dd} file that have been there longer than one week. It is also responsible for writing a daily summary report of system activity to the /var/adm/sa/sa{dd} file. System Accounting Commands That Run Automatically or Manually startup When added to the /etc/rc*.d directories, the startup command initiates startup procedures for the accounting system. shutacct Records the time accounting was turned off by calling the acctwtmp command to write a line to the /var/adm/wtmp file. It then calls the turnacct off command to turn off process accounting. Note: for AIX systems you would modify the /etc/rc file to reflect system accounting run configuration. Manually Executed Commands A member of the adm group or the user adm can execute the following commands: ac Prints connect-time records. (AIX 4.2) acctcom Displays process accounting summaries. (available to all users). acctcon1 Displays connect-time summaries. accton Turns process accounting on and off. chargefee Charges the user a predetermined fee for units of work performed. The charges are added to the daily report by the acctmerg command. fwtmp Converts files between binary and ASCII formats. last Displays information about previous logins. lastcomm Displays information about the last commands that were executed. lastlogin Displays the time each user last logged in. prctmp Displays session records. prtacct Displays total accounting files. sa Summarizes raw accounting information to help manage large volumes of accounting information. (AIX 4.2) sadc Reports on various local system actions, such as buffer usage, disk and tape I/O activity, TTY device activity counters, and file access counters. time Prints real time, user time, and system time required to execute a command. timex Reports in seconds the elapsed time, user time, and execution time. sar Writes to standard output the contents of selected cumulative activity counters in the operating system. The sar command reports only on local activities. Configuration Procedures Setting up system accounting involves configuring certain scripts and system files. The following discusses this process in more detail. Setting Up the AIX 4.2 Accounting System The first step in configuring AIX 4.2 system accounting is ensuring that the files pacct and wtmp exist and have the proper permission settings. As adm, use the nulladm command to set the access permissions to read (r) and write (w) permission for the file owner and group and read (r) permission for others. The nulladm command will also create the files if they do not exist on the system. /usr/sbin/acct/nulladm wtmp pacct A listing of the /var/adm directory structure follows, with the pacct and wtmp files shown: # pwd /var/adm # ls -al drwxrwxr-x 8 root adm 512 May 10 08:00 . drwxr-xr-x 14 bin bin 512 Apr 01 06:03 .. -rwxr----- 1 adm adm 268 May 09 14:48 .profile -rw------- 1 adm adm 676 May 09 22:25 .sh_history drwxrwxr-x 5 adm adm 512 May 09 13:13 acct dr-xr-x--- 2 bin cron 512 Apr 01 05:41 cron -rw-r--r-- 1 adm adm 0 May 09 23:00 dtmp -rw-rw-r-- 1 adm adm 0 May 09 14:46 fee -rw-rw-r-- 1 adm adm 0 May 09 16:08 pacct drwxrwxrwt 2 root system 512 Apr 01 06:14 ras drwxrwxr-x 2 adm adm 512 May 10 00:00 sa -rw-r--r-- 1 root system 3016 May 09 16:08 savacct drwxrwxr-x 2 adm adm 512 Apr 01 05:28 streams -rw------- 1 root system 1039 May 09 21:32 sulog drwxr-xr-x 2 root system 512 Apr 08 08:37 sw -rw-r--r-- 1 root system 106 May 09 16:08 usracct -rw-rw-r-- 1 adm adm 4032 May 10 08:46 wtmp The /etc/acct/holidays file contains entries listing prime-time and observed holidays during a given calendar year. Therefore, this file will require the systems administrator to edit it on an annual basis. Prime time must be the first line in the /etc/acct/holidays file that is not a comment. The prime time hours entry is based on a 24-hour clock, with midnight being either 0000 or 2400. Prime time represents the block of core business hours during a 24-hour period when the system resources are in their greatest demand (for example, transactional systems) by the user community. The /etc/acct/holidays file entry for prime time consists of three four-digit fields in the following order: Current year Beginning of prime time (hhmm) End of prime time (hhmm) For example, to specify the year 1997, with prime time beginning at 7:30 a.m. and ending at 5:30 p.m., add the following line: 1997 0730 1730 Organizational holidays for the year follow the prime time line, with each line consisting of four fields in the following order: Day of the year Month Day of the month Description of holiday The day-of-the-year field contains the numeric day of year (Julian date format--date +%j) on which the holiday occurs, and must be a number from 1 through 365 (366 in leap year). The other three fields are informational. A listing of the /etc/acct/holidays file follows: # cat /etc/acct/holidays * COMPONENT_NAME: (CMDACCT) Command Accounting * * Prime/Nonprime Table for AIX Accounting System * * Curr Prime Non-Prime * Year Start Start * 1997 0730 1730 * * Day of Calendar Company * Year Date Holiday * 1 Jan 1 New Year's Day 146 May 26 Memorial Day (Obsvd.) 185 Jul 4 Independence Day 244 Sep 1 Labor Day 324 Nov 20 Thanksgiving Day 325 Nov 21 Day after Thanksgiving 359 Dec 25 Christmas Day 365 Dec 31 New Years Eve Process accounting is initialized by adding the following line to the /etc/rc program file. /etc/rc is the run control program used when the system is booted to its target run state. The startup procedure records the time that accounting was initialized and cleans up the previous day's accounting files. /usr/bin/su - adm -c /usr/sbin/acct/startup Each filesystem to be included in disk usage accounting must have the account variable set to true in its stanza entry in the /etc/filesystems file. The example stanzas for filesystem /home from /etc/filesystems shows the entry for disk usage accounting set to true and the filesystem stanza for /usr set to false. Therefore, disk usage account will occur for /home and not for /usr. /home: dev = /dev/hd1 vfs = jfs log = /dev/hd8 mount = true check = true vol = /home free = false account = true /usr: dev = /dev/hd2 vfs = jfs log = /dev/hd8 mount = automatic check = false type = bootfs vol = /usr free = false account = false Each printer queue to be included in printer usage accounting must have the acctfile variable pointing to a data file set in the printer queue stanza in /etc/qconfig. The example stanza for the printer queue HP_laser from /etc/qconfig shows printer usage accounting set to the default data file of /var/adm/qacct. Printer queue usage accounting information for the HP_laser queue will be stored in /var/adm/qacct. HP_Laser: device = lp0 acctfile = /var/adm/qacct lp0: file = /dev/lp0 header = never trailer = never access = both backend = /usr/lib/lpd/piobe The nite, fiscal and sum directories must exist under /var/adm/acct so that storage of system accounting information can be maintained. Create the /var/adm/acct/nite, /var/adm/acct/fiscal, and /var/adm/acct/sum directories with permissions setting of 755 with owner and group set to adm. The following generalizes the usage of these directories and shows a sample directory listing of /var/adm/acct. /var/adm/acct/nite Daily data and command files used by runacct /var/adm/acct/sum summary data and command files used by runacct to produce summary reports /var/adm/acct/fiscal summary data and command files used by monacct to produce monthly reports # pwd /var/adm/acct # ls -al drwxrwxr-x 5 adm adm 512 May 09 13:13 . drwxrwxr-x 8 root adm 512 May 10 10:00 .. drwxr-xr-x 2 adm adm 512 May 09 13:13 fiscal drwxr-xr-x 2 adm adm 512 May 09 23:10 nite drwxr-xr-x 2 adm adm 512 May 09 14:46 sum # Login as the adm user and use crontab -e to edit the crontab file to activate the daily accounting functions. By editing the /var/spool/cron/crontabs/adm file, you are allowing cron to control the periodic collection and reporting of statistical data. See the example of the crontab entries for runacct, dodisk, ckpacct, and monacct below: 10 23 * * 0-6 /usr/lib/acct/runacct 2>/usr/adm/acct/nite/accterr > /dev/null 0 23 * * 0-6 /usr/lib/acct/dodisk > /dev/null 2>&1 0 * * * * /usr/lib/acct/ckpacct > /dev/null 2>&1 15 4 1 * * /usr/lib/acct/monacct > /dev/null 2>&1 The first entry starts the runacct at 11:10 p.m. daily to process the active system accounting data files. The second entry starts the dodisk command at 11:00 p.m. daily to collect disk usage statistics. The third entry executes the ckpacct command every hour of every day to ensure that the system accounting /var/adm/pacct file does not exceed the specified default block size (1000 blocks is the normal default). The fourth and final entry executes the monacct command on the first day of the month to generate monthly summary accounting reports. Following is an example of the /var/spool/cron/crontabs/adm file with the runacct, dodisk, ckpacct, and monacct commands listed: #************************************************************************************************************ # # CRONTAB Job listing - Administration - System Level # #************************************************************************************************************ # Min * Hour * Day * Month * Day * # of the * of the * of the * of the * of the * Command Syntax # Day * Day * Month * Year * Week * #************************************************************************************************************ # # PROCESS ACCOUNTING: # runacct at 11:10 every night # dodisk at 11:00 every night # ckpacct every hour on the hour # monthly accounting 4:15 the first of every month #============================================================================================================ 10 23 * * 0-6 /usr/lib/acct/runacct 2>/usr/adm/acct/nite/accterr >/dev/null 0 23 * * 0-6 /usr/lib/acct/dodisk >/dev/null 2>&1 0 * * * * /usr/lib/acct/ckpacct >/dev/null 2>&1 15 4 1 * * /usr/lib/acct/monacct >/dev/null 2>&1 #============================================================================================================ You are now ready for startup or shutdown of the System Accounting process with the following commands: Startup: /usr/bin/su - adm -c /usr/lib/acct/startup Shutdown: /usr/bin/su - adm -c /usr/lib/acct/shutacct You may use the following command to verify the state (on or off) of system accounting processes. # fwtmp < /var/adm/wtmp | pg Sample truncated output: LOGIN .xxx.com: dtremote 6 23528 0000 0000 863276614 Sat May 10 10:03:34 EST 1997 root .xxx.com: dtremote 7 23528 0000 0000 863276629 Sat May 10 10:03:49 EST 1997 LOGIN .xxx.com: dtremote 6 20920 0000 0000 863286997 Sat May 10 12:56:37 EST 1997 root pts/2 pts/2 7 25506 0000 0000 863300368 Sat May 10 16:39:28 EST 1997 AIX, acctg 9 0 0000 0000 863300700 Sat May 10 16:45:00 EST 1997 accting off 9 0 0000 0000 863301549 Sat May 10 16:59:09 EST 1997 AIX, acctg 9 0 0000 0000 863301631 Sat May 10 17:00:31 EST 1997 The above example indicates where the systems administrator, started accounting (16:45), shutdown accounting (16:59) and then restarted accounting (17:00). Setting Up the HP-UX 10.x Accounting System The System Accounting package is usually installed onto the system when the operating system is configured. The administrator can check this with the following command : # swlist -l product | grep -i accounting Accounting B.10.10 Accounting If the command does not return line 2 (example shown for a 10.10 HP-UX operating system), do not proceed until the "Systems Accounting Package" has been installed. Once the systems administrator has confirmed that the "Systems Accounting Package" has been installed, he may proceed with the following configuration guidelines. The first step in configuring HP-UX 10.x system accounting is ensuring that the files pacct and wtmp exist and have the proper permission settings. As root, use the nulladm command to set the access permissions to read (r) and write (w) permission for the file owner and group and read (r) permission for others. The nulladm command will also create the files if they do not exist on the system. # /usr/lib/acct/nulladm wtmp pacct A listing of the /var/adm directory structure follows, with the pacct and wtmp files highlighted: # pwd /var/adm # ls -al drwxrwxr-x 8 root adm 512 May 10 08:00 . drwxr-xr-x 14 bin bin 512 Apr 01 06:03 .. -rwxr----- 1 adm adm 268 May 09 14:48 .profile -rw------- 1 adm adm 676 May 09 22:25 .sh_history drwxrwxr-x 5 adm adm 512 May 09 13:13 acct dr-xr-x--- 2 bin cron 512 Apr 01 05:41 cron -rw-r--r-- 1 adm adm 0 May 09 23:00 dtmp -rw-rw-r-- 1 adm adm 0 May 09 14:46 fee -rw-rw-r-- 1 adm adm 0 May 09 16:08 pacct drwxrwxrwt 2 root system 512 Apr 01 06:14 ras drwxrwxr-x 2 adm adm 512 May 10 00:00 sa -rw-r--r-- 1 root system 3016 May 09 16:08 savacct drwxrwxr-x 2 adm adm 512 Apr 01 05:28 streams -rw------- 1 root system 1039 May 09 21:32 sulog drwxr-xr-x 2 root system 512 Apr 08 08:37 sw -rw-r--r-- 1 root system 106 May 09 16:08 usracct -rw-rw-r-- 1 adm adm 4032 May 10 08:46 wtmp # Following the above step, the systems administrator needs to edit the /etc/rc.config.d/acct file and set START_ACCT equal to one (1). This will start systems accounting each time the system is reset. An example of this is # Process accounting. # # START_ACCT: Set to 1 to start process accounting # START_ACCT=1 The /etc/acct/holidays file contains entries listing prime-time and observed holidays during a given calendar year. Therefore, this file will require the systems administrator to edit it on an annual basis. Prime time must be the first line in the /etc/acct/holidays file that is not a comment. The prime time hours entry is based on a 24-hour clock, with midnight being either 0000 or 2400. Prime time represents the block of core business hours during a 24-hour period when the system resources are in their greatest demand (transactional systems) by the user community. The /etc/acct/holidays file entry for prime time consists of three four-digit fields in the following order: Current year Beginning of prime time (hhmm) End of prime time (hhmm) For example, to specify the year 1997, with prime time beginning at 7:30 a.m. and ending at 5:30 p.m., add the following line: 1997 0730 1730 Organizational holidays for the year follow the prime time line, with each line consisting of four fields in the following order: Day of the year Month Day of the month Description of holiday The day-of-the-year field contains the numeric day of year (Julian date format--date +%j) on which the holiday occurs and must be a number from 1 through 365 (366 on leap year). The other three fields are only informational. A listing of the /etc/acct/holidays file follows: # cat /etc/acct/holidays * COMPONENT_NAME: (CMDACCT) Command Accounting * * Prime/Nonprime Table for HP-UX Accounting System * * Curr Prime Non-Prime * Year Start Start * 1997 0730 1730 * * Day of Calendar Company * Year Date Holiday * 1 Jan 1 New Year's Day 146 May 26 Memorial Day (Obsvd.) 185 Jul 4 Independence Day 244 Sep 1 Labor Day 324 Nov 20 Thanksgiving Day 325 Nov 21 Day after Thanksgiving 359 Dec 25 Christmas Day 365 Dec 31 New Years Eve Disk Accounting Statistics Each filesystem to be included in disk usage accounting must, by default, exist in the /etc/fstab file. The dodisk command has the option to accept the special filenames as input from the command line. If this is the case, only those special filenames listed will be included in the accounting process. If you wish to generate a report for a single disk device, for example, a filesystem under Logical Volume Manager(LVM), you would use the following command: # /usr/lib/acct/dodisk /dev/vg_name/lvol_name NOTE: Logical Volume Manager is Hewlett-Packards (HP) subsystem for managing disk space. Its main feature is that it allows the systems administrator to group multiple physical disk drives under one filesystem. If you wish to provide a sublist of filesystems from the /etc/fstab file, through your system editor create a file that contains the special device names for your filesystems--one filesystem per line. You would use the following command to read in a list of special files to include in the disk accounting process: # /usr/lib/acct/dodisk < list.filesystems The nite, fiscal, and sum directories must exist under /var/adm/acct so that storage of system accounting information can be maintained. Create the /var/adm/acct/nite, /var/adm/acct/fiscal, and /var/adm/acct/sum directories with permission settings of 755 with owner and group set to adm. The following generalizes the usage of these directories and shows a sample directory listing of /var/adm/acct. /var/adm/acct/nite Daily data and command files used by runacct /var/adm/acct/sum Summary data and command files used by runacct to produce summary reports /var/adm/acct/fiscal Summary data and command files used by monacct to produce monthly reports A listing of the /var/adm/acct directory: # pwd /var/adm/acct # ls -al drwxrwxr-x 5 adm adm 512 May 09 13:13 . drwxrwxr-x 8 root adm 512 May 10 10:00 .. drwxr-xr-x 2 adm adm 512 May 09 13:13 fiscal drwxr-xr-x 2 adm adm 512 May 09 23:10 nite drwxr-xr-x 2 adm adm 512 May 09 14:46 sum # Login as the adm user and use crontab -e to edit the crontab file to activate the daily accounting functions. By editing the /var/spool/cron/crontabs/adm file, you are allowing cron to control the periodic collection and reporting of statistical data. See the example of the crontab entries for runacct, dodisk, ckpacct, and monacct below: 10 23 * * 0-6 /usr/lib/acct/runacct 2>/usr/adm/acct/nite/accterr > /dev/null 0 23 * * 0-6 /usr/lib/acct/dodisk > /dev/null 2>&1 0 * * * * /usr/lib/acct/ckpacct > /dev/null 2>&1 15 4 1 * * /usr/lib/acct/monacct > /dev/null 2>&1 The first entry starts the runacct command at 11:10 p.m. daily to process the active system accounting data files. The second entry starts the dodisk command at 11:00 p.m. daily to collect disk usage statistics. The third entry executes the ckpacct command every hour of every day to ensure that the system accounting /var/adm/pacct file does not exceed the specified default block size (1000 blocks is the normal default). The fourth and final entry executes the monacct command on the first day of the month to generate monthly summary accounting reports. Following is an example of the /var/spool/cron/crontabs/adm file with the runacct, dodisk, ckpacct, and monacct commands listed: #************************************************************************************************************ # # CRONTAB Job listing - Administration - System Level # #************************************************************************************************************ # Min * Hour * Day * Month * Day * # of the * of the * of the * of the * of the * Command Syntax # Day * Day * Month * Year * Week * #************************************************************************************************************ # # PROCESS ACCOUNTING: # runacct at 11:10 every night # dodisk at 11:00 every night # ckpacct every hour on the hour # monthly accounting 4:15 the first of every month #============================================================================================================ 10 23 * * 0-6 /usr/lib/acct/runacct 2>/usr/adm/acct/nite/accterr >/dev/null 0 23 * * 0-6 /usr/lib/acct/dodisk >/dev/null 2>&1 0 * * * * /usr/lib/acct/ckpacct >/dev/null 2>&1 15 4 1 * * /usr/lib/acct/monacct >/dev/null 2>&1 #============================================================================================================ You are now ready for startup or shutdown of the System Accounting process with the following commands: Startup: /usr/bin/su - adm -c /usr/lib/acct/startup Shutdown: /usr/bin/su - adm -c /usr/lib/acct/shutacct You may use the following command to verify the state (on or off) of System Accounting processes. # fwtmp < /var/adm/wtmp | pg Sample truncated output: rc sqnc 90 8 0000 0000 863231977 May 9 21:39:37 1997 getty cons 1127 5 0000 0000 863231977 May 9 21:39:37 1997 spserver ShPr 1128 5 0000 0000 863231977 May 9 21:39:37 1997 uugetty a0 1130 5 0000 0000 863231977 May 9 21:39:37 1997 LOGIN cons console 1127 6 0000 0000 863231977 May 9 21:39:37 1997 LOGIN a0 ttyd0p7 1130 6 0000 0000 863231977 May 9 21:39:37 1997 acctg on 0 9 0000 0000 863232395 May 9 21:46:35 1997 root p1 ttyp1 634 8 0000 0000 863236183 May 9 22:49:43 1997 LOGIN p1 pty/ttyp1 1712 6 0000 0000 863270875 May 10 08:27:55 1997 root p1 ttyp1 1712 7 0000 0003 863270881 May 10 08:28:01 1997 root p1 ttyp1 1712 8 0000 0000 863281484 May 10 11:24:44 1997 LOGIN p1 pty/ttyp1 1923 6 0000 0000 863288678 May 10 13:24:38 1997 root p1 ttyp1 1923 7 0000 0003 863288690 May 10 13:24:50 1997 LOGIN p2 pty/ttyp2 2155 6 0000 0000 863294925 May 10 15:08:45 1997 acctg off 0 9 0000 0000 863300425 May 10 16:40:25 1997 The above example indicates where the systems administrator started accounting (21:46:35) and shut down accounting (16:40:25). Setting Up the Solaris 2.5 Accounting System Begin by making sure that SUNWaccr and SUNWaccu software packages are installed. # pkginfo -l SUNWaccu Sample output: PKGINST: SUNWaccu NAME: System Accounting, (Usr) CATEGORY: system ARCH: sparc VERSION: 11.5.1,REV=95.10.27.15.23 BASEDIR: / VENDOR: Sun Microsystems, Inc. DESC: utilities for accounting and reporting of system activity PSTAMP: raid951027152556 INSTDATE: Jun 11 1997 08:13 HOTLINE: Please contact your local service provider STATUS: completely installed FILES: 43 installed pathnames 4 shared pathnames 5 directories 36 executables 1 setuid/setgid executables 453 blocks used (approx) # pkginfo -l SUNWaccr sample output: PKGINST: SUNWaccr NAME: System Accounting, (Root) CATEGORY: system ARCH: sparc VERSION: 11.5.1,REV=95.10.27.15.23 BASEDIR: / VENDOR: Sun Microsystems, Inc. DESC: utilities for accounting and reporting of system activity PSTAMP: raid951027152552 INSTDATE: Jun 11 1997 08:13 HOTLINE: Please contact your local service provider STATUS: completely installed FILES: 18 installed pathnames 7 shared pathnames 1 linked files 13 directories 2 executables 6 blocks used (approx) If you do not receive output similar to the above example listings, use either pkgadd or swmtool to install these software packages. Set up the link necessary for starting system accounting at system initialization. # ln /etc/init.d/acct /etc/rc2.d/S22acct Set up the link necessary for shutting down system accounting at system shutdown. # ln /etc/init.d/acct /etc/rc0.d/K22acct Add the following entries to the /var/spool/cron/crontabs/adm file: 0 * * * * /usr/lib/acct/ckpacct 10 23 * * * /usr/lib/acct/runacct 2> /var/adm/acct/nite/fd2log 15 04 1 * * /usr/lib/acct/monacct Please note that these entries will be processed by crontab file for the adm user and must follow the cron format. #************************************************************************************************************ # # CRONTAB Job listing - adm - System Level # #************************************************************************************************************ # Min * Hour * Day * Month * Day * # of the * of the * of the * of the * of the * Command Syntax # Day * Day * Month * Year * Week * #************************************************************************************************************ # # PROCESS ACCOUNTING: # runacct at 11:10 every night # ckpacct every hour on the hour # monthly accounting 4:15 the first of every month #============================================================================================================ 10 23 * * 0-6 /usr/lib/acct/runacct 2>/usr/adm/acct/nite/fd2log 0 * * * * /usr/lib/acct/ckpacct >/dev/null 2>&1 15 4 1 * * /usr/lib/acct/monacct >/dev/null 2>&1 #============================================================================================================ Add the following entry to the /var/spool/cron/crontabs/root file: 00 23 * * 0-6 /usr/lib/acct/dodisk >/dev/null 2>&1 #************************************************************************************************************ # # CRONTAB Job listing - Root - System Level # #************************************************************************************************************ # Min * Hour * Day * Month * Day * # of the * of the * of the * of the * of the * Command Syntax # Day * Day * Month * Year * Week * #************************************************************************************************************ # # PROCESS ACCOUNTING: # dodisk at 11:00 every night #============================================================================================================ 0 23 * * 0-6 /usr/lib/acct/dodisk >/dev/null 2>&1 #============================================================================================================ Adjust /etc/acct/holidays to reflect both national and company holidays you want your system to recognize. A listing of the /etc/acct/holidays file follows: # cat /etc/acct/holidays * COMPONENT_NAME: (CMDACCT) Command Accounting * * Prime/Nonprime Table for Solaris Accounting System * * Curr Prime Non-Prime * Year Start Start * 1997 0730 1730 * * Day of Calendar Company * Year Date Holiday * 1 Jan 1 New Year's Day 146 May 26 Memorial Day (Obsvd.) 185 Jul 4 Independence Day 244 Sep 1 Labor Day 324 Nov 20 Thanksgiving Day 325 Nov 21 Day after Thanksgiving 359 Dec 25 Christmas Day 365 Dec 31 New Years Eve System accounting can now be started by either rebooting the machine or issuing the runacct command. Take note that executing runacct without any arguments causes the process to assume that this is the first time that runacct has been run for that day. If you are attempting to restart system accounting, be sure to add the appropriate MMDD (DD = Day and MM = Month) argument on the command line. You are now ready for startup or shutdown of the system accounting process with the following commands: Startup: /usr/bin/su - adm -c /usr/lib/acct/startup Shutdown: /usr/bin/su - adm -c /usr/lib/acct/shutacct You may use the following command to verify the state (on or off) of System accounting processes. # fwtmp < /var/adm/wtmp | pg Sample truncated output: .telnet tn20 /dev/pts/4 1118 6 0000 0000 871178077 Sat May 10 20:54:37 1997 root tn20 pts/4 1118 7 0000 0000 871178098 Sat May 10 20:54:58 1997 acctg off 0 9 0000 0000 871179345 Sat May 10 16:10:45 1997 acctg on 0 9 0000 0000 871179352 Sat May 10 21:15:52 1997 The above example indicates where the systems administrator, started accounting (21:15:52) and shutdown accounting (16:10:45). System Accounting Directory Structure Most UNIX system accounting takes advantage of a hierarchical (see Figure 21.1) approach when laying out its control and data files. This allows the accounting process to maintain temporary and permanent files in logical locations. Each directory in this layer stores related groups of files, commands, or other sub-directories. Figure 21.1. System accounting directory structure. According to systems documentation (HP-UX, AIX, and Solaris), the following system accounting structures are laid out as described in the following sections. Please refer to your system's documentation for more detailed information. System Accounting High-Level Directory Layout /var/adm Maintains data-collection files /var/adm/acct Directories for nite, sum and fiscal /var/adm/acct/nite Daily data and command files used by runacct /var/adm/acct/sum Summary data and command files used by runacct to produce summary reports /var/adm/acct/fiscal Summary data and command files used by monacct to produce monthly reports /usr/lib/acct System accounting commands /sbin Shell scripts rc and shutdown procedures /etc/rc.config.d/acct Set variable START_ACCT equal to 1 to activate accounting at system boot (HP-UX 10.X) /etc/rc Run command file that executes at system startup and when the system changes run state. Files in the /var/adm directory /var/adm/diskdiag Diagnostic output during the execution of disk accounting programs /var/adm/dtmp Output from the acctdusg command /var/adm/fee Output from the chargefee command, in ASCII tacct records /var/adm/pacct Active process accounting file /var/adm/wtmp Active process accounting file /var/adm/Spacct?.mmdd Process accounting files for mmdd during the execution of runacct Files in the /var/adm/acct/nite Directory {{mmdd}} {{mmdd}} is the month and day a file was created and is appended to the previous version of the data file. active Contains warning and error messages generated from runacct execution. active{{mmdd}} Copy of the active file after runacct encounters an error condition. ctacct.{{mmdd}} Total accounting records created from connect session accounting. ctmp Output of acctcon1. It contains a list of login sessions sorted by userid and login names. Daycms ASCII daily command summary used by prdaily. daytacct Total accounting records for current day. disktacct Total accounting records created by the dodisk command. fd2log Diagnostic output from the execution of runacct. lastdate The last day runacct was executed, in +%{{m}}%{{d}}format. lock and lock1 Used to control serial use of runacct. lineuse Terminal (tty) line usage report used by prdaily. log Diagnostics output from acctcon1. log{{mmdd}} Same as log after runacct detects an error. reboots Contains beginning and ending dates from wtmp, and a listing of reboots. statefile Used to record the current state being executed by runacct. tmpwtmp wtmp file, corrected by wtmpfix. wtmperror Error messages, if any, from wtmpfix. wtmperrorr{{mmdd}} Same as wtmperror after runacct detects an error. wtmp.{{mmdd}} The previous day's wtmp file. Files in the /var/adm/acct/sum Directory cms Total command summary file for current month in internal summary format. cmsprev Command summary file without latest update. daycms Command summary file for previous day in internal summary format. loginlog Shows the last login date for each user. rpt{{mmdd}} Daily accounting report for date {{mmdd}}. tacct Cumulative total accounting file for current month. tacctprev Same as tacct without latest update. tacct{{mmdd}} Total accounting file for date {{mmdd}}. wtmp.{{mmdd}} Saved copy of wtmp file for date {{mmdd}}. Removed after reboot. Files in the /var/adm/acct/fiscal Directory cms{mm} Total command summary for month {mm} in internal summary format. Fiscrpt{mm} Report similar to prdaily for the month {mm}. tacct{mm} Total accounting file for the month {mm}. The acctmerg command can convert records between ASCII and binary formats and merge records from different sources into a single record for each user. System Accounting Report Generation After completing system accounting configuration, your system is ready to produce accounting reports. The following covers the basics of report generation for Systems Accounting. Generation of System Accounting Data Reports acctcom The acctcom utility allows you to see the accounting system data at any given time. This command may be executed from the command line with several different options. It is one of the most useful commands for getting a quick report from the system without the need to find a file. This option will show the average statistics about processes. $ acctcom -a An example of a truncated listing: COMMAND START END REAL CPU MEAN NAME USER TTYNAME TIME TIME (SECS) (SECS) SIZE(K) #accton root [Dhatch] 17:57:07 17:57:07 0.00 0.00 56.00 #acctwtmp root pts/2 17:57:07 17:57:07 0.00 0.00 60.00 #fwtmp root pts/2 17:57:07 17:57:07 0.03 0.00 160.00 #awk root pts/2 17:57:07 17:57:07 0.02 0.02 106.00 #fwtmp root pts/2 17:57:07 17:57:07 0.05 0.00 0.00 #dspmsg root pts/2 17:57:07 17:57:07 0.00 0.00 0.00 #cat root pts/2 17:57:07 17:57:07 0.00 0.00 336.00 #wtmpfix root pts/2 17:57:07 17:57:07 0.05 0.00 0.00 #dspmsg root pts/2 17:57:07 17:57:07 0.02 0.02 192.00 #acctcon1 root pts/2 17:57:08 17:57:08 0.17 0.02 96.00 #sort root pts/2 17:57:08 17:57:08 0.25 0.00 82.00 #acctcon2 root pts/2 17:57:08 17:57:08 0.05 0.00 168.00 #acctmerg root pts/2 17:57:08 17:57:08 0.05 0.00 0.00 #dspmsg root pts/2 17:57:08 17:57:08 0.00 0.00 0.00 #basename root pts/2 17:57:08 17:57:08 0.03 0.00 138.00 #sed root pts/2 17:57:08 17:57:08 0.03 0.00 136.00 #acctprc1 root pts/2 17:57:08 17:57:08 0.05 0.02 184.00 #acctprc2 root pts/2 17:57:08 17:57:08 0.05 0.00 68.00 #acctmerg root pts/2 17:57:08 17:57:08 0.02 0.00 0.00 #mv root pts/2 17:57:08 17:57:08 0.02 0.00 0.00 #acctcms root pts/2 17:57:09 17:57:09 0.02 0.00 96.00 #lsuser root pts/2 17:57:09 17:57:09 0.86 0.20 89.00 #grep root pts/2 17:57:09 17:57:09 0.86 0.00 164.00 #uniq root pts/2 17:57:10 17:57:10 0.05 0.00 0.00 #egrep root ? 17:57:22 17:57:22 0.03 0.02 114.00 . . . #tail root ? 18:23:09 18:23:09 0.05 0.00 148.00 #fgrep root ? 18:24:10 18:24:10 0.00 0.00 0.00 #egrep root ? 18:24:10 18:24:10 0.00 0.00 0.00 #acctcom root pts/2 18:24:28 18:24:28 0.39 0.27 58.00 cmds=287 Real=2.92 CPU=0.04 USER=0.01 SYS=0.03 CHAR=29767.60 BLK=0.00 USR/TOT=0.24 HOG=1.20 This option will show the amount of user time per total time (system time plus user time). $ acctcom -r An example of a truncated listing: COMMAND START END REAL CPU CPU NAME USER TTYNAME TIME TIME (SECS) (SECS) FACTOR #accton root [Dhatch] 17:57:07 17:57:07 0.00 0.00 0.00 #bsh root pts/2 17:57:06 17:57:06 0.20 0.02 0.00 #mv root pts/2 17:57:07 17:57:07 0.02 0.02 0.00 #cp root pts/2 17:57:07 17:57:07 0.02 0.02 1 #acctwtmp root pts/2 17:57:07 17:57:07 0.02 0.00 0.00 #fwtmp root pts/2 17:57:07 17:57:07 0.02 0.00 0.00 #awk root pts/2 17:57:07 17:57:07 0.03 0.02 0.00 #sed root pts/2 17:57:07 17:57:07 0.03 0.00 0.00 #fwtmp root pts/2 17:57:07 17:57:07 0.08 0.02 1 #cp root pts/2 17:57:07 17:57:07 0.02 0.00 0.00 #chmod root pts/2 17:57:07 17:57:07 0.00 0.00 0.00 #chown root pts/2 17:57:07 17:57:07 0.02 0.00 0.00 #bsh root pts/2 17:57:07 17:57:07 0.08 0.02 0.00 #acctwtmp root pts/2 17:57:07 17:57:07 0.00 0.00 0.00 #fwtmp root pts/2 17:57:07 17:57:07 0.03 0.00 0.00 . . . #telnet root [Dhatch] 17:37:21 18:28:39 3078.00 2.14 0.124 #egrep root ? 18:31:47 18:31:47 0.02 0.00 0.00 #tail root ? 18:31:47 18:31:47 0.06 0.02 0.00 sendmail root ? 18:33:32 18:33:32 0.02 0.00 0.00 #acctcom root pts/2 18:33:51 18:33:51 0.47 0.36 0.304 This option will show all the processes that have been executed by the user wdwood. $ acctcom -u wdwood An example of a truncated listing: COMMAND START END REAL CPU MEAN NAME USER TTYNAME TIME TIME (SECS) (SECS) SIZE(K) #accton wdwood [Dhatch] 17:57:07 17:57:07 0.00 0.00 56.00 #bsh wdwood pts/2 17:57:06 17:57:06 0.20 0.02 0.00 #mv wdwood pts/2 17:57:07 17:57:07 0.02 0.02 0.00 #cp wdwood pts/2 17:57:07 17:57:07 0.02 0.02 182.00 #acctwtmp wdwood pts/2 17:57:07 17:57:07 0.02 0.00 0.00 #fwtmp wdwood pts/2 17:57:07 17:57:07 0.02 0.00 0.00 #awk wdwood pts/2 17:57:07 17:57:07 0.03 0.02 121.00 #sed wdwood pts/2 17:57:07 17:57:07 0.03 0.00 0.00 #fwtmp wdwood pts/2 17:57:07 17:57:07 0.08 0.02 108.00 #cp wdwood pts/2 17:57:07 17:57:07 0.02 0.00 72.00 #chmod wdwood pts/2 17:57:07 17:57:07 0.00 0.00 0.00 #chown wdwood pts/2 17:57:07 17:57:07 0.02 0.00 86.00 #bsh wdwood pts/2 17:57:07 17:57:07 0.08 0.02 130.00 . . . #dspmsg wdwood pts/2 18:38:08 18:38:08 0.02 0.00 0.00 #bsh wdwood pts/2 18:38:07 18:38:08 1.08 0.02 97.00 #more wdwood pts/2 18:38:20 18:38:26 6.66 0.02 0.00 #acctcom wdwood pts/2 18:38:38 18:38:38 0.48 0.33 35.00 #cat wdwood pts/2 18:38:45 18:38:45 0.02 0.00 170.00 This option will show all the processes, for any user, running longer than 20 seconds. $ acctcom -O 20 COMMAND START END REAL CPU MEAN NAME USER TTYNAME TIME TIME (SECS) (SECS) SIZE(K) #find wdwood [Dhatch] 18:18:43 18:19:05 22.58 6.45 30.00 To see more options for the acctcom command, or any of the system accounting commands, please refer to your man pages or system documentation manuals. Daily Automated Reports The system accounting processes generate a number of automated reports that can assist the systems administrator in viewing the daily usage of a system. The Daily Report Shows the usage of ports on your system. The Daily Usage Shows the system resources used by your users during a daily period. The Daily Command Summary Report The Total command Summary Report Shows the commands run on your system and the resources those commands used. This report can be essential in helping you determine the processes that might be a potential bottleneck in your system. Daily Systems Accounting Summary Report Tells you the last time a login ID was used to access the system. This report may be used to help you identify login IDs no longer in use. The Daily Report The Daily Report is found in the /var/adm/acct/nite directory. It is an ASCII file called lineuse and can be viewed with any available text viewer or editor. $ cat /var/adm/acct/nite/lineuse Example file contents: TOTAL DURATION: 474 MINUTES LINE MINUTES PERCENT # SESS # ON # OFF dtremote 173 36 1 1 2 lft0 0 0 0 0 1 pts/0 0 0 0 0 1 pts/1 0 0 0 0 1 pts/2 77 16 3 3 4 TOTALS 250 -- 4 4 9 The definition of each column in this report are as follows: LINE The port that was used to access the system. MINUTES The number of minutes the port was active during this daily period. PERCENT The number of minutes the port was active divided by the TOTAL DURATION factor. TOTAL DURATION is the sum of the minutes the system was a multi-user run state. # SESS The number of times the port was accessed to log in to the system. # ON The number of times the port was used for login purposes. # OFF The number of logoffs handled by that port and the number of interrupts like Ctrl-c, EOF, and so on. The Daily Usage Report The Daily Usage Report is found in the /var/adm/acct directory. It is a binary file called daytacct that is to be accessed with the prtacct accounting command. $ prtacct -v /var/adm/acct/nite/daytacct Fri May 9 16:02:04 EST 1997 Page 1 LOGIN CPU CPU KCORE KCORE CONNECT CONNECT DISK FEES # OF # OF # DISK UID NAME PRIME NPRIME PRIME NPRIME PRIME NPRIME BLOCKS PROCS SESS SAMPLES 0 TOTAL 0 0 0 0 9448 14739 0 0 0 83 0 0 japierce 0 0 0 0 8526 13904 0 0 0 46 0 0 dwilson 0 0 0 0 508 814 0 0 0 21 0 0 kvwood 0 0 0 0 412 0 0 0 0 8 0 223 wpierce 0 0 0 0 0 21 0 0 0 5 0 237 awilson 0 0 0 0 1 0 0 0 0 2 0 273 wdwood 0 0 0 0 1 0 0 0 0 1 0 The definition of each column in this report are as follows: UID The user's identification number. LOGIN NAME The user's name. CPU prime/non prime The amount of time the user's program required the use of CPU. This is rounded up to the nearest minute. KCORE prime/non prime The amount of memory per minute used to run the programs. This is rounded up to the nearest kilobyte. CONNECT prime/non prime Total time the user was actually connected to the system. DISK BLOCKS The number of disk blocks used. # OF PROCS The number of processes the user executed. # OF SESS The number of sessions the user incurred by logging in. # DISK SAMPLES The number of times acctdusg or diskusg was run to cumulate the average number of DISK BLOCKS. FEE The total amount of usage charges accessed to the user for this given period. Daily Command Summary Report and Total Command Summary Report The Daily Command Summary Report is found in the /var/adm/acct/nite directory. It is an ASCII file called daycms and can be viewed with any available text viewer or editor. $ cat /var/adm/acct/nite/daycms TOTAL COMMAND SUMMARY COMMAND NUMBER TOTAL TOTAL TOTAL MEAN MEAN HOG CHARS BLOCKS NAME CMDS KCOREMIN CPU-MIN REAL-MIN SIZE-K CPU-MIN FACTOR TRNSFD READ TOTALS 82 12.68 0.06 21.91 209.92 0.00 0.28 6.636e+06 0.00 man 1 7.56 0.02 1.68 440.00 0.02 1.02 5.566e+06 0.00 vi 1 2.24 0.02 0.53 121.00 0.02 3.49 71936.00 0.00 ls 5 1.15 0.01 0.02 108.15 0.00 68.33 117144.00 0.00 fgrep 14 0.39 0.00 0.01 124.17 0.00 42.86 286776.00 0.00 tail 14 0.36 0.00 0.02 126.82 0.00 18.03 142744.00 0.00 bsh 6 0.28 0.00 0.01 99.27 0.00 27.50 49410.00 0.00 ps 1 0.21 0.00 0.00 137.00 0.00 66.67 19696.00 0.00 ftpd 1 0.20 0.00 0.81 155.00 0.00 0.16 41576.00 0.00 sendmail 1 0.12 0.00 0.00 468.00 0.00 100.00 13744.00 0.00 fwtmp 3 0.07 0.00 0.00 143.00 0.00 25.00 35840.00 0.00 more 2 0.05 0.00 2.41 195.00 0.00 0.01 30144.00 0.00 pg 3 0.03 0.00 14.78 28.50 0.00 0.01 61232.00 0.00 ksh 2 0.00 0.00 0.00 0.00 0.00 0.00 18360.00 0.00 rm 6 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 accton 2 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 acctwtmp 2 0.00 0.00 0.00 0.00 0.00 0.00 128.00 0.00 egrep 14 0.00 0.00 0.00 0.00 0.00 0.00 143976.00 0.00 grep 1 0.00 0.00 0.00 0.00 0.00 0.00 23976.00 0.00 dspmsg 2 0.00 0.00 0.00 0.00 0.00 0.00 8214.00 0.00 sh 1 0.00 0.00 1.64 0.00 0.00 0.02 5058.00 0.00 The Total Command Summary Report looks like the preceding report with one exception. It is usually a monthly summary showing total accumulated since the last month or the last execution of monacct. The Total Command Summary Report is found in the /var/adm/acct/sum directory. It is an ASCII file called cms and can be viewed with any available text viewer or editor. The definitions of each column in this report are as follows: COMMAND NAME The name of the command. NUMBER COMMANDS The total number of times the command has been executed. KCOREMIN The total cumulative kilobytes segments used by the command. TOTAL CPU-MIN The total processing time in minutes. REAL-MIN The actual processing time in minutes. MEAN SIZE-K The mean of TOTAL KCOREMIN divided by execution. MENU CPU-MIN The mean of executions divided by total processing time in minutes. HOG FACTOR The total processing time divided by elapsed time. This is the utilization ratio of the system. CHARS TRNSFD The total number of reads and writes to the filesystem. BLOCKS READ The total number of physical block reads and writes. Daily Systems Accounting Summary Report This report is generated by the runacct command via cron. This report is found in the /var/adm/acct/sum directory and is a file whose format is rprt{MMDD}. This file is a summary report of daily activity for the system. The Daily Systems Accounting Summary Report is found in the /var/adm/acct/sum directory. It is an ASCII file and can be viewed with any available text viewer or editor. An example of this report follows: $ cat /var/adm/acct/sum/rprt0510 Sat May 10 21:41:50 EST 1997 DAILY REPORT FOR AIX Page 1 from Sat May 10 21:27:28 EST 1997 to Sat May 10 21:41:46 EST 1997 1 openacct 1 runacct 1 acctcon1 TOTAL DURATION: 14 MINUTES LINE MINUTES PERCENT # SESS # ON # OFF lft0 14 100 1 1 1 pts/0 14 100 1 1 1 pts/1 14 100 1 1 1 pts/2 14 100 1 1 1 pts/3 14 100 1 1 1 TOTALS 72 -- 5 5 5 Sat May 10 21:41:50 EST 1997 DAILY USAGE REPORT FOR AIX Page 1 LOGIN CPU CPU KCORE KCORE CONNECT CONNECT DISK FEES # OF # OF # DISK UID NAME PRIME NPRIME PRIME NPRIME PRIME NPRIME BLOCKS PROCS SESS SAMPLES 0 TOTAL 0 0 0 7 0 72 5 0 216 5 4 0 root 0 0 0 1 0 72 1 0 28 5 1 2 bin 0 0 0 0 0 0 1 0 0 0 1 4 adm 0 0 0 6 0 0 0 0 188 0 0 100 guest 0 0 0 0 0 0 1 0 0 0 1 200 servdir 0 0 0 0 0 0 2 0 0 0 1 Sat May 10 21:41:48 EST 1997 DAILY COMMAND SUMMARY Page 1 TOTAL COMMAND SUMMARY COMMAND NUMBER TOTAL TOTAL TOTAL MEAN MEAN HOG CHARS BLOCKS NAME CMDS KCOREMIN CPU-MIN REAL-MIN SIZE-K CPU-MIN FACTOR TRNSFD READ TOTALS 216 6.91 0.05 7.42 132.59 0.00 0.70 1.707e+07 4094.00 diskusg 1 3.73 0.03 0.11 142.00 0.03 23.22 1.625e+07 4094.00 bsh 15 1.28 0.01 0.24 129.47 0.00 4.20 49810.00 0.00 awk 6 0.27 0.00 0.00 175.67 0.00 37.50 48971.00 0.00 ls 6 0.25 0.00 0.00 136.14 0.00 87.50 37662.00 0.00 tail 6 0.13 0.00 0.01 96.80 0.00 18.52 61176.00 0.00 sendmail 1 0.12 0.00 0.00 462.00 0.00 100.00 13744.00 0.00 dspmsg 18 0.11 0.00 0.00 212.00 0.00 33.33 74259.00 0.00 cat 17 0.11 0.00 0.00 136.00 0.00 60.00 1615.00 0.00 acctcms 4 0.10 0.00 0.00 201.00 0.00 50.00 65520.00 0.00 fgrep 6 0.09 0.00 0.00 84.25 0.00 36.36 122904.00 0.00 sort 7 0.09 0.00 0.03 112.00 0.00 3.03 15302.00 0.00 acctmerg 6 0.08 0.00 0.00 105.00 0.00 37.50 9064.00 0.00 vi 1 0.07 0.00 0.11 127.00 0.00 0.48 17912.00 0.00 egrep 6 0.06 0.00 0.00 124.00 0.00 33.33 61704.00 0.00 chown 14 0.06 0.00 0.00 48.80 0.00 35.71 15988.00 0.00 grep 3 0.06 0.00 0.01 121.00 0.00 3.70 7971.00 0.00 date 9 0.05 0.00 0.00 198.00 0.00 50.00 169.00 0.00 acctprc1 1 0.04 0.00 0.00 74.00 0.00 66.67 23672.00 0.00 acctcon1 1 0.04 0.00 0.00 142.00 0.00 50.00 7883.00 0.00 uniq 3 0.04 0.00 0.02 142.00 0.00 1.16 6269.00 0.00 ypcat 2 0.03 0.00 0.00 129.00 0.00 6.25 58000.00 0.00 more 1 0.03 0.00 6.82 101.00 0.00 0.00 11384.00 0.00 pr 5 0.02 0.00 0.00 94.00 0.00 14.29 26094.00 0.00 rm 7 0.02 0.00 0.00 82.00 0.00 9.09 5058.00 0.00 lsuser 1 0.01 0.00 0.01 19.00 0.00 7.14 4600.00 0.00 sed 7 0.00 0.00 0.01 0.00 0.00 0.00 30745.00 0.00 fwtmp 4 0.00 0.00 0.00 0.00 0.00 10.00 10270.00 0.00 getopt 3 0.00 0.00 0.00 0.00 0.00 0.00 48.00 0.00 chmod 15 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 acctwtmp 2 0.00 0.00 0.00 0.00 0.00 0.00 128.00 0.00 uname 1 0.00 0.00 0.00 0.00 0.00 0.00 4.00 0.00 wtmpfix 1 0.00 0.00 0.00 0.00 0.00 0.00 3072.00 0.00 mv 7 0.00 0.00 0.00 0.00 0.00 0.00 5058.00 0.00 acctcon2 1 0.00 0.00 0.00 0.00 0.00 100.00 660.00 0.00 accton 1 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 df 1 0.00 0.00 0.00 0.00 0.00 0.00 733.00 0.00 basename 2 0.00 0.00 0.00 0.00 0.00 0.00 23.00 0.00 expr 1 0.00 0.00 0.00 0.00 0.00 0.00 2.00 0.00 cp 19 0.00 0.00 0.00 0.00 0.00 0.00 10012.00 0.00 wc 1 0.00 0.00 0.00 0.00 0.00 0.00 1203.00 0.00 acctprc2 1 0.00 0.00 0.00 0.00 0.00 0.00 12736.00 0.00 acctdisk 1 0.00 0.00 0.00 0.00 0.00 0.00 339.00 0.00 ln 1 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 Sat May 10 21:41:48 EST 1997 MONTHLY TOTAL COMMAND SUMMARY Page 1 TOTAL COMMAND SUMMARY COMMAND NUMBER TOTAL TOTAL TOTAL MEAN MEAN HOG CHARS BLOCKS NAME CMDS KCOREMIN CPU-MIN REAL-MIN SIZE-K CPU-MIN FACTOR TRNSFD READ TOTALS 1771 281.68 1.22 706.08 231.12 0.00 0.17 1.423e+08 4094.00 dtterm 2 136.19 0.24 81.83 566.58 0.12 0.29 333760.00 0.00 man 11 79.59 0.18 4.64 431.09 0.02 3.98 5.915e+07 0.00 bsh 135 7.74 0.06 13.13 124.32 0.00 0.47 705187.00 0.00 find 2 6.64 0.21 0.74 31.00 0.11 28.78 13764.00 0.00 lsuser 24 5.85 0.08 0.28 72.03 0.00 29.21 117880.00 0.00 ksh 27 4.60 0.03 189.72 178.53 0.00 0.01 637811.00 0.00 crash 1 3.89 0.02 3.19 237.00 0.02 0.51 2.635e+07 0.00 diskusg 1 3.73 0.03 0.11 142.00 0.03 23.22 1.625e+07 4094.00 acctcom 18 3.30 0.05 0.09 62.18 0.00 62.01 839000.00 0.00 telnet 2 3.25 0.05 79.10 65.62 0.02 0.06 417920.00 0.00 errpt 8 3.13 0.01 0.03 267.40 0.00 41.67 2.129e+06 0.00 telnetd 5 2.40 0.06 107.89 40.19 0.01 0.06 762960.00 0.00 tail 102 2.31 0.02 0.26 99.48 0.00 8.77 1.04e+06 0.00 fgrep 102 2.03 0.02 0.05 113.25 0.00 37.30 2.089e+06 0.00 ls 75 2.00 0.02 0.04 116.15 0.00 45.21 603775.00 0.00 vi 16 1.46 0.01 37.87 116.81 0.00 0.03 330912.00 0.00 more 35 1.21 0.01 26.19 125.30 0.00 0.04 518424.00 0.00 awk 25 0.96 0.01 0.04 175.33 0.00 14.09 141725.00 0.00 dspmsg 98 0.74 0.00 0.01 166.24 0.00 50.00 493457.00 0.00 uniq 50 0.69 0.01 0.55 115.74 0.00 1.09 142133.00 0.00 grep 33 0.59 0.00 0.30 126.22 0.00 1.54 237104.00 0.00 ps 6 0.59 0.01 0.03 86.88 0.00 25.49 104784.00 0.00 rm 75 0.59 0.01 0.04 75.23 0.00 17.75 404784.00 0.00 file 13 0.52 0.00 0.01 110.83 0.00 36.00 461053.00 0.00 sort 59 0.52 0.01 0.55 90.45 0.00 1.04 280988.00 0.00 sendmail 8 0.48 0.00 0.00 463.00 0.00 44.44 109952.00 0.00 date 96 0.46 0.00 0.01 194.89 0.00 33.33 21536.00 0.00 acctcms 15 0.42 0.00 0.01 179.22 0.00 45.00 267903.00 0.00 acctcon1 16 0.41 0.00 0.01 142.45 0.00 22.92 180989.00 0.00 egrep 102 0.40 0.00 0.02 102.33 0.00 16.13 1.049e+06 0.00 chown 49 0.38 0.01 0.01 55.54 0.00 49.06 155734.00 0.00 sh 26 0.34 0.00 4.22 131.70 0.00 0.06 156818.00 0.00 ftpd 1 0.33 0.00 57.30 212.00 0.00 0.00 184320.00 0.00 acctprc2 3 0.30 0.00 0.01 130.00 0.00 39.13 91430.00 0.00 lslpp 4 0.28 0.00 0.03 135.75 0.00 8.25 108864.00 0.00 sadc 4 0.28 0.01 0.08 24.09 0.00 13.92 2.402e+07 0.00 strings 7 0.27 0.00 0.00 95.00 0.00 61.11 76242.00 0.00 cp 84 0.26 0.00 0.02 166.67 0.00 7.79 28181.00 0.00 cat 66 0.26 0.00 0.01 163.33 0.00 27.27 93983.00 0.00 sed 44 0.25 0.00 0.28 117.75 0.00 0.74 245587.00 0.00 acctprc1 4 0.24 0.00 2.77 115.25 0.00 0.08 167963.00 0.00 mv 36 0.21 0.00 11.51 81.50 0.00 0.02 61310.00 0.00 servdir. 4 0.17 0.00 0.19 79.87 0.00 1.10 2876.00 0.00 ibm.psa 4 0.16 0.00 0.05 105.17 0.00 3.12 60576.00 0.00 termdef 8 0.14 0.00 0.00 182.00 0.00 50.00 80960.00 0.00 acctmerg 24 0.14 0.00 0.01 74.14 0.00 17.50 49956.00 0.00 chmod 65 0.13 0.00 0.00 121.50 0.00 33.33 50596.00 0.00 pr 20 0.12 0.00 0.01 155.33 0.00 6.52 83028.00 0.00 ibmelh.p 4 0.12 0.00 0.03 76.50 0.00 5.88 41760.00 0.00 uname 13 0.09 0.00 0.01 89.00 0.00 15.38 91318.00 0.00 Sat May 10 21:41:49 EST 1997 LAST LOGIN Page 1 00-00-00 guest 00-00-00 jwpierce 97-05-09 enwilson 00-00-00 lpd 97-05-09 bmwood 97-05-09 bmwood2 00-00-00 nuucp 97-05-09 sawood 97-05-10 root 00-00-00 servdir 97-05-09 tswilson Summary This chapter explained the basics of UNIX system accounting, provided a list of commands and their respective definitions, and supplied configuration procedures for HP-UX 10.X and IBM AIX 4.2. The system accounting directory structure was discussed, and accounting reports were defined and generated. This information may be used by a number of individuals to: Establish an equitable charge back system Monitor overall system resource usage Used as a basis for establishing resource quota requirements Provide information to management for cost justification Forecast This chapter has provided basic information for the systems administrator to implement systems accounting. Used properly, the information can be of great value in helping to manage current resources in a fair manner for all users and processes. This information will also help justify, from a cost basis, future computer purchases.

©Copyright, Macmillan Computer Publishing. All rights reserved.