17.3 System V-Style Accounting: AIX, HP-UX, and Solaris

The System V-style accounting scheme is much more elaborate than the BSD-style variant. It is used byAIX, HP-UX, and Solaris systems.

This facility is a complex system of commands, shell scripts, and C programs, called by one another in long sequences, all purported to be totally automated and requiring little or no intervention. In reality, it's a design only a fervent partisan could love (although, to be fair, it does generally get the job done on stable systems). Older versions of the manual pages alternated between assuring the reader that the system was robust, reliable, and trouble-free and describing convoluted procedures for patching corrupted accounting data files. Most of the latter has been edited out at this point, but be forewarned.

The main accounting file is named pacct, usually found in /var/adm . Other key subdirectories used by the system are found under /var/adm/acct:

fiscal

Reports by fiscal period (usually month) and old binary fiscal period summary files

nite

Daily binary summary file; daily processed accounting record; raw disk accounting records; and status, error log, and lock files

sum

Binary daily and current fiscal period cumulative summary files and daily reports

On AIX systems, these subdirectories have to be created by hand:

# cd /var/adm/acct # mkdir -m 755 fiscal nite sum # chown adm.adm fiscal nite sum 

In addition to the wtmp and pacct files discussed previously, there are some other raw data files generated by this accounting system:

/var/adm/acct/nite/diskacct

Raw disk usage data.

/var/adm/fee

Administrator-entered additional charge records, using the chargefee command. chargefee allows an administrator to record charges for special services not covered by the accounting system; these charges will automatically be incorporated into the accounting system. It takes two arguments: a username and the number of units to be charged to that user. For example, the following command charges user chavez 10 units:

# chargefee chavez 10

Figure 17-1 illustrates the general flow of data in the System V accounting system, beginning with the raw data files discussed previously. Commands and the operating system enter data into the raw data files, which are processed by a series of utilities, producing several intermediate binary summary files and culminating in ASCII reports suitable for use by the system administrator. All of this processing is handled automatically by cron once accounting is set up.

Figure 17-1. System V-style accounting (simplified)

On Tru64 systems, the files and subdirectories in /var/adm are context-dependent symbolic links (see Section 2.1). Keep this in mind if you need to create or recreate any accounting system components.

17.3.1 Setting Up Accounting

While accounting is not enabled by default under System V, it is, to a large extent, already set up. The following steps are necessary to enable accounting:

• Verify that a script to start the accounting system is run at boot time. On HP-UX and Solaris systems, you need to verify that the init.d/acct script is linked to files in the appropriate rcn.d or /etc/rc3.d subdirectory. On AIX systems, you need to add a command like the following to one of the system startup scripts (the same one called on the other systems):

  /bin/su - adm -c /usr/sbin/acct/startup

  The startup script calls the accton command to initiate accounting.

  The following command shuts down accounting:

  /usr/lib/acct/shutacct

  Under AIX, this command is included in /etc/shutdown by default.

• Add cron entries for various accounting utilities. Add the following entries (or a variation of them) to the crontab file for user adm:

  # control accounting file size (3:30 a.m. daily)  0  *  *  *       /usr/sbin/acct/ckpacct # process accounting raw data (4:30 a.m. daily)  30 4  *  *  *    /usr/sbin/acct/runacct 2>                    /var/adm/acct/nite/fd2log # generate monthly reports (5:30 a.m. on the first)  30 5  1  *  *    /usr/sbin/acct/monacct

  Note that the second entry is wrapped to fit the page.

  Similar entries may already be present on the system in an active or commented-out form. Note that the accounting utilities directory is /usr/lib/acct on Solaris systems.

• Add an entry like the following to the crontab file for root:

         # generate disk usage raw data         # (10:30 p.m. on Saturdays and the 29th)  30 22 29  *  7   /usr/sbin/acct/dodisk

• Edit the /etc/acct/holidays data file to reflect prime and nonprime hours andholidays days where all day is considered nonprime at your site. Here is an example of this file:

  * Prime/Nonprime Table for Accounting System  *  * Curr  Prime  Non-Prime  * Year  Start   Start    2001    0900    2100  *  * Day of  Calendar    Holiday  * Year    Date      1     Jan 1       New Year's Day        15     Jan 15      Martin Luther King Day   149     May 29      Memorial Day ...

  The first section consists of a single active line (comments are indicated by the initial asterisk) listing the current year, the time at which prime (full price) time starts and when it ends, using a 24-hour clock. The second section lists holidays to be recognized by the accounting system. The fields in each line are the numerical day of the year (Julian date), conventionally followed by a readable date and a description; the accounting system uses only the first field.

• On AIX systems, you must enable accounting for each filesystem for which you want to collect disk accounting data with chfs command, as in this example:

  # chfs -a accounting=true /chem

  The resulting entry in /etc/filesystems will now look something like this:

  /chem:    dev= /dev/us00         vfs= jfs         log= /dev/logus00        mount= true     check= true        options= rw    account= true    Accounting is    enabled.

Once these steps are completed, accounting will begin at the next boot. It may be started manually instead:

# /bin/su - adm -c /usr/sbin/acct/startup

The startup script is located in /usr/lib/acct on Solaris systems.

17.3.2 Accounting Reports

Dailyaccounting reports are stored in files in the sum subdirectory, with names of the form rprtmmdd, where mm and dd are the month and day, respectively. Each report file contains five separate reports, covering these areas:

• Per-user usage

• Last login time for each user

• Command use, for the previous day and the previous month

• Terminal/pseudo-terminal activity

Here is a sample of the daily per-user usage report, the most useful section of the daily report file from an accounting perspective:

March  7 10:43 2001   DAILY USAGE REPORT FOR hamlet                           Page 1         LOGIN  CPU  (MINS)  KCORE-MINS   CONNECT(MINS) DISK   # OF   # OF  # DISK   FEE UID  NAME  PRIME NPRIME PRIME NPRIME  PRIME NPRIME  BLOCKS PROCS  SESS  SAMPLES  0    TOTAL 40    101     9      34     393    124      0   1186    19      0      0 0    root   5     10     2      11     102     12      0   1129    10      0      0 473  wang  35     91     7      23     291    112      0     57     9      0      0

The resources used during prime and nonprime hours (as defined in the holidays file) are totaled separately by the accounting system (to allow for different charge rates).

The first line of the report is a total line, giving total system usage. After that, there is one line per UID. The fields have the following meanings:

UID

User's UID.

LOGIN NAME

Username.

CPU (MINS)

Total CPU time for all of the user's processes in minutes.

KCORE-MINS

Total memory used by running processes, in kilobyte-minutes. Basically, this field relates to the product of the memory used times the length of use, summed over all the user's processes. It is an indication of how much memory the user's processes consumed, but it has little to do with the amount of memory that was actually used.

CONNECT (MINS)

Total connect time (how long the user was logged in).

DISK BLOCKS

Average total amount of disk space used by the user.

# OF PROCS

Total number of processes belonging to this user.

# OF SESS

Number of distinct login sessions.

# DISK SAMPLES

Number of times dodisk was run during the accounting period, giving a measure of how many values the DISK BLOCKS field is averaged over. If dodisk has not been run, this field and the DISK BLOCKS field will contain a 0.

FEE

Total fees entered with chargefee.

The daily and monthly command-use reports in the same report file show system resource usage by command name, including the number of times each command was run and the total CPU time, memory use, and I/O transactions it consumed. The terminal activity report shows the percentage of time each terminal line or pseudo-terminal was in use over the accounting period, the total connect time accumulated on it, and the number of distinct login sessions (not that useful a report anymore). The last login report displays the date of the last login for each UID defined in the password file.

The monthly accounting reports are stored in files named fiscrptmm, where mm indicates the month. They are very similar to the daily reports just described.

17.3.3 Solaris Project-Based Extended Accounting

Solaris provides extended accounting for keeping track of system resource usage by project. This facility is independent of the standard System V accounting system also provided by Solaris.

Projects are defined in the /etc/project configuration file. Solaris provides several utilities for defining projects and assigning users and groups to them, as illustrated in the following examples.

The following command creates a new project called animate, assigns it a project ID of 105, and assigns user chavez and groups grarts and design to it:

# projadd -c "Animation Project" -U chavez -G grarts,design -p 105 animate

Similarly, the following command creates the cad project without assigning any members and lets the system assign the next highest project ID:

# projadd cad

The following commands replace the user list for the animate project and rename the cad project to cae:

# projmod -U chavez,wong animate # projmod -l cae cad

The following command removes the y2k project:

# projdel y2k

Here are the /etc/project file entries corresponding to the two projects we just created:

animate:105:Animation Project:chavez,wong:grarts,design: cad:110::::

The contents of each field are obvious, with the exception of the last field, which can be used to define project-specific attributes.

The projects command lists the projects to which the current user or a specified user belongs:

# projects chavez default chemdev animate

The -v option lists project descriptions and their names.

At login, the user is placed into the default project or, if there is not default project, into the first project of which she is a member. She can change the current project by executing the newtask command:

$ newtask -p animate

The command also optionally takes a command as its final argument, allowing a user to execute a single command for another project. The command also supports a -F option to start a finalized task, one from which another task may not be started.

The new project option (-p) is not required. If it is omitted, a new task in the current project is started. Extended accounting data can be collected on a per-task and/or per-process basis. The newtask command would be used to delimit tasks if the former is desired.

You enable collection of the additional accounting data (project and task settings) using the acctadm command, as in these examples:

# acctadm -e extended,host,mstate -f /var/adm/exact/task task # acctadm -e extended,host,mstate -f /var/adm/exact/pacct process

The two commands enable task-based (i.e., based on invocations of newtask) and per-process accounting by project (the type is indicated by the final keyword). The -e option specifies the data to be collected (we have enabled everything here), and the -f option specifies the path to the raw accounting data file where records should be written.

Without options, the acctadm command displays the current state of the extended accounting system:

# acctadm             Task accounting: active        Task accounting file: /var/adm/exacct/task      Tracked task resources: extended,host,mstate    Untracked task resources: none          Process accounting: active     Process accounting file: /var/adm/exacct/pacct   Tracked process resources: extended,host,mstate Untracked process resources: none

You must provide your own methods and tools for managing these raw accounting files and processing the records within them.

17.3.4 The upacct Package

The upacct package, written by D. J. Nixon and available free of charge, provides a way to merge the System V-style accounting data from multiple hosts into a single repository. It provides a variety of commands and scripts related to these functions. We will focus on a few of them here.

The upacct command is used to create host-based accounting data summary files and to merge multiple such files together. For example, the following command creates a host-based data file from the standard raw accounting data file:

# upacct cmds.hamlet -p /var/adm/pact

This command creates the file cmds.hamlet in the current directory.

The following command merges several host-based data files into the file cmds.0:

# upacct cmds.0 cmds.hamlet cmds.dalton cmds.garden

The command's first argument indicates the output file. Additional data filenames refer to files to be merged, and the -p option points to any raw accounting data file to be included as well.

Conventionally, the host-based data files are given names of the form cmds.nnnn where the extension is a four-digit number. However, you can use any names you like, provided you modify the package's shell scripts to reflect your choice.

The package includes two shell scripts that are useful for reporting on the collected data: ucomm.sh and wcomm.sh. Both need to be edited prior to their initial use to specify the path to the host-based data files on your system (and to reflect any nonstandard file name conventions). Here is an example of running ucomm.sh, which takes a username whose data is to be retrieved as its argument:

# ucomm.sh chavez l510.exe    --    176.45 secs   aurora   Tue May 15 15:18:50 2001     tail    --    270.12 secs   hamlet   Tue May 15 15:11:34 2001      top    --     11.14 secs   garden   Tue May 15 15:11:21 2001

The fields in the display hold the command name, accounting flags, CPU time (in seconds), host, and command start time (respectively). Given this sort of data, it is quite easy to generate reports on per-user and per-system usage levels. We saw an example script of this sort in Chapter 14.

The wcomm.sh command is very similar, differing only in that it takes a command name as its argument and displays the username in the first column of its output.