UNIX Unleashed, System Administrator's Edition
The UNIX accounting system collects information on individual and group usage of the computer system resources. You may use this information as an accounting charge back system to bill users for the system resources utilized during a prescribed billing cycle. Accounting reports generated by the system accounting utilities provide information the systems administrator may use to assess current resource assignments, set resource limits and quotas, and forecast future resource requirements. This chapter will cover:
Once the computer system has been initialized, and assuming the system accounting option is enabled, statistical collection begins. The data collection process encompasses the following categories:
The accounting system process begins by gathering statistical data from which summary reports can be generated. These reports may be used to assist in system performance analysis and provide the criteria necessary to establish an equitable customer charge back billing system. The aforementioned report categories include several types of reporting data that is collected to make up the accounting reports. Each category is described in the following sections.
The business units responsible for the organization's information technology (IT) services may use connect session statistics to charge customers for the time spent using system resources. This allows an organization to bill or charge back based on a user's actual connect time. Connect-session accounting data, related to user login and logout, is collected by the init and login commands. When a user logs in, the login program makes an entry in the /var/adm/wtmp file. These records maintain the following user information:
This information can be used to produce reports containing the following information:
System accounting also gathers statistics by individual processes. Examples of collected statistics include:
The statistical information is maintained in the accounting file /var/adm/pacct. This file is accessed by many of the accounting commands used with system accounting. After a process terminates, the kernel writes process specific information to the /var/adm/pacct file. This file contains:
System accounting provides commands to display, report, and summarize process information. Commands also exist (for example, the ckpacct command) to ensure that the process accounting file (/var/adm/pacct) does not grow beyond a specific size.
System accounting provides the ability for the systems administrator to monitor disk utilization by users. To restrict users to a specified disk usage limit, the systems administrator may implement a disk quota system. As a note, systems administrators should be aware that users can evade charges and quota restrictions for disk usage by changing the ownership of their files to that of another user. This allows an unsuspecting user to be charged fees that are rightfully someone else's. Disk usage commands perform three basic functions:
Printer usage data is stored in the /var/adm/qacct file in ASCII format. The qdaemon will write the ASCII data to the /var/adm/qacct file after a print job is completed. The record of data stored for each printer queue contains the following data:
UNIX systems accounting supports numerous commands that can be run via cron and/or the command line. The following discusses some of these commands and the suggested execution method.
There are several command entries that the systems administrator must install in the crontab file /var/spool/cron/crontabs/adm to begin collecting accounting data. This is the cron file for the adm user who owns all the accounting files and processes. These commands are intended to be executed by cron in a batch mode, but can be manually executed from the command line.
| runacct | Maintains the daily accounting procedures. This command works with the acctmerg command to produce the daily summary report files sorted by user name. |
| ckpacct | Controls the size of the /var/adm/pacct file. When the /var/adm/pacct file grows larger than a specified number of blocks (default = 1000 blocks), it turns off accounting and moves the file off to a location equal to /var/adm/pacctx (x is the number of the file). Then ckpacct creates a new /var/adm/pacct for statistic storage. When the amount of free space on the filesystem falls below a designated threshold (default = 500 blocks), ckpacct automatically turns off process accounting. Once the free space exceeds the threshold, ckpacct restarts process accounting. |
| dodisk | Dodisk produces disk usage accounting records by using the diskusg, acctdusg, and acctdisk commands. In the default case, dodisk creates disk accounting records on the special files. These special filenames are maintained in /etc/fstab for HP-UX 10.x and /etc/filesystems for AIX 4.2.x. |
| monacct | Uses the daily reports created by the commands above to produce monthly summary reports. |
| sa1 | System accounting data is collected and maintained in binary format in the file /var/adm/sa/sa{dd}, where {dd} is the day of the month. |
| sa2 | This command removes reports from the /var/adm/sa/sa{dd} file that have been there longer than one week. It is also responsible for writing a daily summary report of system activity to the /var/adm/sa/sa{dd} file. |
| startup | When added to the /etc/rc*.d directories, the startup command initiates startup procedures for the accounting system. |
| shutacct | Records the time accounting was turned off by calling the acctwtmp command to write a line to the /var/adm/wtmp file. It then calls the turnacct off command to turn off process accounting. |
Note: for AIX systems you would modify the /etc/rc file to reflect system accounting run configuration.
A member of the adm group or the user adm can execute the following commands:
| ac | Prints connect-time records. (AIX 4.2) |
| acctcom | Displays process accounting summaries. (available to all users). |
| acctcon1 | Displays connect-time summaries. |
| accton | Turns process accounting on and off. |
| chargefee | Charges the user a predetermined fee for units of work performed. The charges are added to the daily report by the acctmerg command. |
| fwtmp | Converts files between binary and ASCII formats. |
| last | Displays information about previous logins. |
| lastcomm | Displays information about the last commands that were executed. |
| lastlogin | Displays the time each user last logged in. |
| prctmp | Displays session records. |
| prtacct | Displays total accounting files. |
| sa | Summarizes raw accounting information to help manage large volumes of accounting information. (AIX 4.2) |
| sadc | Reports on various local system actions, such as buffer usage, disk and tape I/O activity, TTY device activity counters, and file access counters. |
| time | Prints real time, user time, and system time required to execute a command. |
| timex | Reports in seconds the elapsed time, user time, and execution time. |
| sar | Writes to standard output the contents of selected cumulative activity counters in the operating system. The sar command reports only on local activities. |
Setting up system accounting involves configuring certain scripts and system files. The following discusses this process in more detail.
The first step in configuring AIX 4.2 system accounting is ensuring that the files pacct and wtmp exist and have the proper permission settings. As adm, use the nulladm command to set the access permissions to read (r) and write (w) permission for the file owner and group and read (r) permission for others. The nulladm command will also create the files if they do not exist on the system.
/usr/sbin/acct/nulladm wtmp pacct
A listing of the /var/adm directory structure follows, with the pacct and wtmp files shown:
# pwd /var/adm # ls -al drwxrwxr-x 8 root adm 512 May 10 08:00 . drwxr-xr-x 14 bin bin 512 Apr 01 06:03 .. -rwxr----- 1 adm adm 268 May 09 14:48 .profile -rw------- 1 adm adm 676 May 09 22:25 .sh_history drwxrwxr-x 5 adm adm 512 May 09 13:13 acct dr-xr-x--- 2 bin cron 512 Apr 01 05:41 cron -rw-r--r-- 1 adm adm 0 May 09 23:00 dtmp -rw-rw-r-- 1 adm adm 0 May 09 14:46 fee -rw-rw-r-- 1 adm adm 0 May 09 16:08 pacct drwxrwxrwt 2 root system 512 Apr 01 06:14 ras drwxrwxr-x 2 adm adm 512 May 10 00:00 sa -rw-r--r-- 1 root system 3016 May 09 16:08 savacct drwxrwxr-x 2 adm adm 512 Apr 01 05:28 streams -rw------- 1 root system 1039 May 09 21:32 sulog drwxr-xr-x 2 root system 512 Apr 08 08:37 sw -rw-r--r-- 1 root system 106 May 09 16:08 usracct -rw-rw-r-- 1 adm adm 4032 May 10 08:46 wtmp
The /etc/acct/holidays file contains entries listing prime-time and observed holidays during a given calendar year. Therefore, this file will require the systems administrator to edit it on an annual basis.
Prime time must be the first line in the /etc/acct/holidays file that is not a comment. The prime time hours entry is based on a 24-hour clock, with midnight being either 0000 or 2400. Prime time represents the block of core business hours during a 24-hour period when the system resources are in their greatest demand (for example, transactional systems) by the user community. The /etc/acct/holidays file entry for prime time consists of three four-digit fields in the following order:
For example, to specify the year 1997, with prime time beginning at 7:30 a.m. and ending at 5:30 p.m., add the following line:
1997 0730 1730
Organizational holidays for the year follow the prime time line, with each line consisting of four fields in the following order:
The day-of-the-year field contains the numeric day of year (Julian date format--date +%j) on which the holiday occurs, and must be a number from 1 through 365 (366 in leap year). The other three fields are informational.
A listing of the /etc/acct/holidays file follows:
# cat /etc/acct/holidays
* COMPONENT_NAME: (CMDACCT) Command Accounting
*
* Prime/Nonprime Table for AIX Accounting System
*
* Curr Prime Non-Prime
* Year Start Start
*
1997 0730 1730
*
* Day of Calendar Company
* Year Date Holiday
*
1 Jan 1 New Year's Day
146 May 26 Memorial Day (Obsvd.)
185 Jul 4 Independence Day
244 Sep 1 Labor Day
324 Nov 20 Thanksgiving Day
325 Nov 21 Day after Thanksgiving
359 Dec 25 Christmas Day
365 Dec 31 New Years Eve
Process accounting is initialized by adding the following line to the /etc/rc program file. /etc/rc is the run control program used when the system is booted to its target run state. The startup procedure records the time that accounting was initialized and cleans up the previous day's accounting files.
/usr/bin/su - adm -c /usr/sbin/acct/startup
Each filesystem to be included in disk usage accounting must have the account variable set to true in its stanza entry in the /etc/filesystems file. The example stanzas for filesystem /home from /etc/filesystems shows the entry for disk usage accounting set to true and the filesystem stanza for /usr set to false. Therefore, disk usage account will occur for /home and not for /usr.
/home:
dev = /dev/hd1
vfs = jfs
log = /dev/hd8
mount = true
check = true
vol = /home
free = false
account = true
/usr:
dev = /dev/hd2
vfs = jfs
log = /dev/hd8
mount = automatic
check = false
type = bootfs
vol = /usr
free = false
account = false
Each printer queue to be included in printer usage accounting must have the acctfile variable pointing to a data file set in the printer queue stanza in /etc/qconfig. The example stanza for the printer queue HP_laser from /etc/qconfig shows printer usage accounting set to the default data file of /var/adm/qacct. Printer queue usage accounting information for the HP_laser queue will be stored in /var/adm/qacct.
HP_Laser:
device = lp0
acctfile = /var/adm/qacct
lp0:
file = /dev/lp0
header = never
trailer = never
access = both
backend = /usr/lib/lpd/piobe
The nite, fiscal and sum directories must exist under /var/adm/acct so that storage of system accounting information can be maintained. Create the /var/adm/acct/nite, /var/adm/acct/fiscal, and /var/adm/acct/sum directories with permissions setting of 755 with owner and group set to adm. The following generalizes the usage of these directories and shows a sample directory listing of /var/adm/acct.
| /var/adm/acct/nite | Daily data and command files used by runacct |
| /var/adm/acct/sum | summary data and command files used by runacct to produce summary reports |
| /var/adm/acct/fiscal | summary data and command files used by monacct to produce monthly reports |
# pwd /var/adm/acct # ls -al drwxrwxr-x 5 adm adm 512 May 09 13:13 . drwxrwxr-x 8 root adm 512 May 10 10:00 .. drwxr-xr-x 2 adm adm 512 May 09 13:13 fiscal drwxr-xr-x 2 adm adm 512 May 09 23:10 nite drwxr-xr-x 2 adm adm 512 May 09 14:46 sum #
Login as the adm user and use crontab -e to edit the crontab file to activate the daily accounting functions. By editing the /var/spool/cron/crontabs/adm file, you are allowing cron to control the periodic collection and reporting of statistical data. See the example of the crontab entries for runacct, dodisk, ckpacct, and monacct below:
10 23 * * 0-6 /usr/lib/acct/runacct 2>/usr/adm/acct/nite/accterr > /dev/null 0 23 * * 0-6 /usr/lib/acct/dodisk > /dev/null 2>&1 0 * * * * /usr/lib/acct/ckpacct > /dev/null 2>&1 15 4 1 * * /usr/lib/acct/monacct > /dev/null 2>&1
The first entry starts the runacct at 11:10 p.m. daily to process the active system accounting data files. The second entry starts the dodisk command at 11:00 p.m. daily to collect disk usage statistics. The third entry executes the ckpacct command every hour of every day to ensure that the system accounting /var/adm/pacct file does not exceed the specified default block size (1000 blocks is the normal default). The fourth and final entry executes the monacct command on the first day of the month to generate monthly summary accounting reports. Following is an example of the /var/spool/cron/crontabs/adm file with the runacct, dodisk, ckpacct, and monacct commands listed:
#************************************************************************************************************ # # CRONTAB Job listing - Administration - System Level # #************************************************************************************************************ # Min * Hour * Day * Month * Day * # of the * of the * of the * of the * of the * Command Syntax # Day * Day * Month * Year * Week * #************************************************************************************************************ # # PROCESS ACCOUNTING: # runacct at 11:10 every night # dodisk at 11:00 every night # ckpacct every hour on the hour # monthly accounting 4:15 the first of every month #============================================================================================================ 10 23 * * 0-6 /usr/lib/acct/runacct 2>/usr/adm/acct/nite/accterr >/dev/null 0 23 * * 0-6 /usr/lib/acct/dodisk >/dev/null 2>&1 0 * * * * /usr/lib/acct/ckpacct >/dev/null 2>&1 15 4 1 * * /usr/lib/acct/monacct >/dev/null 2>&1 #============================================================================================================
You are now ready for startup or shutdown of the System Accounting process with the following commands:
Startup: /usr/bin/su - adm -c /usr/lib/acct/startup Shutdown: /usr/bin/su - adm -c /usr/lib/acct/shutacct
You may use the following command to verify the state (on or off) of system accounting processes.
# fwtmp < /var/adm/wtmp | pg
Sample truncated output:
LOGIN .xxx.com: dtremote 6 23528 0000 0000 863276614 Sat May 10 10:03:34 EST 1997
root .xxx.com: dtremote 7 23528 0000 0000 863276629 Sat May 10 10:03:49 EST 1997
LOGIN .xxx.com: dtremote 6 20920 0000 0000 863286997 Sat May 10 12:56:37 EST 1997
root pts/2 pts/2 7 25506 0000 0000 863300368 Sat May 10 16:39:28 EST 1997
AIX, acctg 9 0 0000 0000 863300700 Sat May 10 16:45:00 EST 1997
accting off 9 0 0000 0000 863301549 Sat May 10 16:59:09 EST 1997
AIX, acctg 9 0 0000 0000 863301631 Sat May 10 17:00:31 EST 1997
The above example indicates where the systems administrator, started accounting (16:45), shutdown accounting (16:59) and then restarted accounting (17:00).
The System Accounting package is usually installed onto the system when the operating system is configured. The administrator can check this with the following command :
# swlist -l product | grep -i accounting Accounting B.10.10 Accounting
If the command does not return line 2 (example shown for a 10.10 HP-UX operating system), do not proceed until the "Systems Accounting Package" has been installed.
Once the systems administrator has confirmed that the "Systems Accounting Package" has been installed, he may proceed with the following configuration guidelines.
The first step in configuring HP-UX 10.x system accounting is ensuring that the files pacct and wtmp exist and have the proper permission settings. As root, use the nulladm command to set the access permissions to read (r) and write (w) permission for the file owner and group and read (r) permission for others. The nulladm command will also create the files if they do not exist on the system.
# /usr/lib/acct/nulladm wtmp pacct
A listing of the /var/adm directory structure follows, with the pacct and wtmp files highlighted:
# pwd /var/adm # ls -al drwxrwxr-x 8 root adm 512 May 10 08:00 . drwxr-xr-x 14 bin bin 512 Apr 01 06:03 .. -rwxr----- 1 adm adm 268 May 09 14:48 .profile -rw------- 1 adm adm 676 May 09 22:25 .sh_history drwxrwxr-x 5 adm adm 512 May 09 13:13 acct dr-xr-x--- 2 bin cron 512 Apr 01 05:41 cron -rw-r--r-- 1 adm adm 0 May 09 23:00 dtmp -rw-rw-r-- 1 adm adm 0 May 09 14:46 fee -rw-rw-r-- 1 adm adm 0 May 09 16:08 pacct drwxrwxrwt 2 root system 512 Apr 01 06:14 ras drwxrwxr-x 2 adm adm 512 May 10 00:00 sa -rw-r--r-- 1 root system 3016 May 09 16:08 savacct drwxrwxr-x 2 adm adm 512 Apr 01 05:28 streams -rw------- 1 root system 1039 May 09 21:32 sulog drwxr-xr-x 2 root system 512 Apr 08 08:37 sw -rw-r--r-- 1 root system 106 May 09 16:08 usracct -rw-rw-r-- 1 adm adm 4032 May 10 08:46 wtmp #
Following the above step, the systems administrator needs to edit the /etc/rc.config.d/acct file and set START_ACCT equal to one (1). This will start systems accounting each time the system is reset. An example of this is
# Process accounting. # # START_ACCT: Set to 1 to start process accounting # START_ACCT=1
The /etc/acct/holidays file contains entries listing prime-time and observed holidays during a given calendar year. Therefore, this file will require the systems administrator to edit it on an annual basis.
Prime time must be the first line in the /etc/acct/holidays file that is not a comment. The prime time hours entry is based on a 24-hour clock, with midnight being either 0000 or 2400. Prime time represents the block of core business hours during a 24-hour period when the system resources are in their greatest demand (transactional systems) by the user community. The /etc/acct/holidays file entry for prime time consists of three four-digit fields in the following order:
For example, to specify the year 1997, with prime time beginning at 7:30 a.m. and ending at 5:30 p.m., add the following line:
1997 0730 1730
Organizational holidays for the year follow the prime time line, with each line consisting of four fields in the following order:
The day-of-the-year field contains the numeric day of year (Julian date format--date +%j) on which the holiday occurs and must be a number from 1 through 365 (366 on leap year). The other three fields are only informational.
A listing of the /etc/acct/holidays file follows:
# cat /etc/acct/holidays
* COMPONENT_NAME: (CMDACCT) Command Accounting
*
* Prime/Nonprime Table for HP-UX Accounting System
*
* Curr Prime Non-Prime
* Year Start Start
*
1997 0730 1730
*
* Day of Calendar Company
* Year Date Holiday
*
1 Jan 1 New Year's Day
146 May 26 Memorial Day (Obsvd.)
185 Jul 4 Independence Day
244 Sep 1 Labor Day
324 Nov 20 Thanksgiving Day
325 Nov 21 Day after Thanksgiving
359 Dec 25 Christmas Day
365 Dec 31 New Years Eve
Each filesystem to be included in disk usage accounting must, by default, exist in the /etc/fstab file. The dodisk command has the option to accept the special filenames as input from the command line. If this is the case, only those special filenames listed will be included in the accounting process. If you wish to generate a report for a single disk device, for example, a filesystem under Logical Volume Manager(LVM), you would use the following command:
# /usr/lib/acct/dodisk /dev/vg_name/lvol_name
NOTE: Logical Volume Manager is Hewlett-Packards (HP) subsystem for managing disk space. Its main feature is that it allows the systems administrator to group multiple physical disk drives under one filesystem.
If you wish to provide a sublist of filesystems from the /etc/fstab file, through your system editor create a file that contains the special device names for your filesystems--one filesystem per line. You would use the following command to read in a list of special files to include in the disk accounting process:
# /usr/lib/acct/dodisk < list.filesystems
The nite, fiscal, and sum directories must exist under /var/adm/acct so that storage of system accounting information can be maintained. Create the /var/adm/acct/nite, /var/adm/acct/fiscal, and /var/adm/acct/sum directories with permission settings of 755 with owner and group set to adm. The following generalizes the usage of these directories and shows a sample directory listing of /var/adm/acct.
| /var/adm/acct/nite | Daily data and command files used by runacct |
| /var/adm/acct/sum | Summary data and command files used by runacct to produce summary reports |
| /var/adm/acct/fiscal | Summary data and command files used by monacct to produce monthly reports |
A listing of the /var/adm/acct directory:
# pwd /var/adm/acct # ls -al drwxrwxr-x 5 adm adm 512 May 09 13:13 . drwxrwxr-x 8 root adm 512 May 10 10:00 .. drwxr-xr-x 2 adm adm 512 May 09 13:13 fiscal drwxr-xr-x 2 adm adm 512 May 09 23:10 nite drwxr-xr-x 2 adm adm 512 May 09 14:46 sum #
Login as the adm user and use crontab -e to edit the crontab file to activate the daily accounting functions. By editing the /var/spool/cron/crontabs/adm file, you are allowing cron to control the periodic collection and reporting of statistical data. See the example of the crontab entries for runacct, dodisk, ckpacct, and monacct below:
10 23 * * 0-6 /usr/lib/acct/runacct 2>/usr/adm/acct/nite/accterr > /dev/null 0 23 * * 0-6 /usr/lib/acct/dodisk > /dev/null 2>&1 0 * * * * /usr/lib/acct/ckpacct > /dev/null 2>&1 15 4 1 * * /usr/lib/acct/monacct > /dev/null 2>&1
The first entry starts the runacct command at 11:10 p.m. daily to process the active system accounting data files. The second entry starts the dodisk command at 11:00 p.m. daily to collect disk usage statistics. The third entry executes the ckpacct command every hour of every day to ensure that the system accounting /var/adm/pacct file does not exceed the specified default block size (1000 blocks is the normal default). The fourth and final entry executes the monacct command on the first day of the month to generate monthly summary accounting reports. Following is an example of the /var/spool/cron/crontabs/adm file with the runacct, dodisk, ckpacct, and monacct commands listed:
#************************************************************************************************************ # # CRONTAB Job listing - Administration - System Level # #************************************************************************************************************ # Min * Hour * Day * Month * Day * # of the * of the * of the * of the * of the * Command Syntax # Day * Day * Month * Year * Week * #************************************************************************************************************ # # PROCESS ACCOUNTING: # runacct at 11:10 every night # dodisk at 11:00 every night # ckpacct every hour on the hour # monthly accounting 4:15 the first of every month #============================================================================================================ 10 23 * * 0-6 /usr/lib/acct/runacct 2>/usr/adm/acct/nite/accterr >/dev/null 0 23 * * 0-6 /usr/lib/acct/dodisk >/dev/null 2>&1 0 * * * * /usr/lib/acct/ckpacct >/dev/null 2>&1 15 4 1 * * /usr/lib/acct/monacct >/dev/null 2>&1 #============================================================================================================
You are now ready for startup or shutdown of the System Accounting process with the following commands:
Startup: /usr/bin/su - adm -c /usr/lib/acct/startup Shutdown: /usr/bin/su - adm -c /usr/lib/acct/shutacct
You may use the following command to verify the state (on or off) of System Accounting processes.
# fwtmp < /var/adm/wtmp | pg
Sample truncated output:
rc sqnc 90 8 0000 0000 863231977 May 9 21:39:37 1997
getty cons 1127 5 0000 0000 863231977 May 9 21:39:37 1997
spserver ShPr 1128 5 0000 0000 863231977 May 9 21:39:37 1997
uugetty a0 1130 5 0000 0000 863231977 May 9 21:39:37 1997
LOGIN cons console 1127 6 0000 0000 863231977 May 9 21:39:37 1997
LOGIN a0 ttyd0p7 1130 6 0000 0000 863231977 May 9 21:39:37 1997
acctg on 0 9 0000 0000 863232395 May 9 21:46:35 1997
root p1 ttyp1 634 8 0000 0000 863236183 May 9 22:49:43 1997
LOGIN p1 pty/ttyp1 1712 6 0000 0000 863270875 May 10 08:27:55 1997
root p1 ttyp1 1712 7 0000 0003 863270881 May 10 08:28:01 1997
root p1 ttyp1 1712 8 0000 0000 863281484 May 10 11:24:44 1997
LOGIN p1 pty/ttyp1 1923 6 0000 0000 863288678 May 10 13:24:38 1997
root p1 ttyp1 1923 7 0000 0003 863288690 May 10 13:24:50 1997
LOGIN p2 pty/ttyp2 2155 6 0000 0000 863294925 May 10 15:08:45 1997
acctg off 0 9 0000 0000 863300425 May 10 16:40:25 1997
The above example indicates where the systems administrator started accounting (21:46:35) and shut down accounting (16:40:25).
Begin by making sure that SUNWaccr and SUNWaccu software packages are installed.
# pkginfo -l SUNWaccu
Sample output:
PKGINST: SUNWaccu
NAME: System Accounting, (Usr)
CATEGORY: system
ARCH: sparc
VERSION: 11.5.1,REV=95.10.27.15.23
BASEDIR: /
VENDOR: Sun Microsystems, Inc.
DESC: utilities for accounting and reporting of system activity
PSTAMP: raid951027152556
INSTDATE: Jun 11 1997 08:13
HOTLINE: Please contact your local service provider
STATUS: completely installed
FILES: 43 installed pathnames
4 shared pathnames
5 directories
36 executables
1 setuid/setgid executables
453 blocks used (approx)
# pkginfo -l SUNWaccr
sample output:
PKGINST: SUNWaccr
NAME: System Accounting, (Root)
CATEGORY: system
ARCH: sparc
VERSION: 11.5.1,REV=95.10.27.15.23
BASEDIR: /
VENDOR: Sun Microsystems, Inc.
DESC: utilities for accounting and reporting of system activity
PSTAMP: raid951027152552
INSTDATE: Jun 11 1997 08:13
HOTLINE: Please contact your local service provider
STATUS: completely installed
FILES: 18 installed pathnames
7 shared pathnames
1 linked files
13 directories
2 executables
6 blocks used (approx)
If you do not receive output similar to the above example listings, use either pkgadd or swmtool to install these software packages.
Set up the link necessary for starting system accounting at system initialization.
# ln /etc/init.d/acct /etc/rc2.d/S22acct
Set up the link necessary for shutting down system accounting at system shutdown.
# ln /etc/init.d/acct /etc/rc0.d/K22acct
Add the following entries to the /var/spool/cron/crontabs/adm file:
0 * * * * /usr/lib/acct/ckpacct
10 23 * * * /usr/lib/acct/runacct 2> /var/adm/acct/nite/fd2log
15 04 1 * * /usr/lib/acct/monacct
Please note that these entries will be processed by crontab file for the adm user and must follow the cron format.
#************************************************************************************************************ # # CRONTAB Job listing - adm - System Level # #************************************************************************************************************ # Min * Hour * Day * Month * Day * # of the * of the * of the * of the * of the * Command Syntax # Day * Day * Month * Year * Week * #************************************************************************************************************ # # PROCESS ACCOUNTING: # runacct at 11:10 every night # ckpacct every hour on the hour # monthly accounting 4:15 the first of every month #============================================================================================================ 10 23 * * 0-6 /usr/lib/acct/runacct 2>/usr/adm/acct/nite/fd2log 0 * * * * /usr/lib/acct/ckpacct >/dev/null 2>&1 15 4 1 * * /usr/lib/acct/monacct >/dev/null 2>&1 #============================================================================================================
Add the following entry to the /var/spool/cron/crontabs/root file:
00 23 * * 0-6 /usr/lib/acct/dodisk >/dev/null 2>&1
#************************************************************************************************************ # # CRONTAB Job listing - Root - System Level # #************************************************************************************************************ # Min * Hour * Day * Month * Day * # of the * of the * of the * of the * of the * Command Syntax # Day * Day * Month * Year * Week * #************************************************************************************************************ # # PROCESS ACCOUNTING: # dodisk at 11:00 every night #============================================================================================================ 0 23 * * 0-6 /usr/lib/acct/dodisk >/dev/null 2>&1 #============================================================================================================
Adjust /etc/acct/holidays to reflect both national and company holidays you want your system to recognize.
A listing of the /etc/acct/holidays file follows:
# cat /etc/acct/holidays
* COMPONENT_NAME: (CMDACCT) Command Accounting
*
* Prime/Nonprime Table for Solaris Accounting System
*
* Curr Prime Non-Prime
* Year Start Start
*
1997 0730 1730
*
* Day of Calendar Company
* Year Date Holiday
*
1 Jan 1 New Year's Day
146 May 26 Memorial Day (Obsvd.)
185 Jul 4 Independence Day
244 Sep 1 Labor Day
324 Nov 20 Thanksgiving Day
325 Nov 21 Day after Thanksgiving
359 Dec 25 Christmas Day
365 Dec 31 New Years Eve
System accounting can now be started by either rebooting the machine or issuing the runacct command. Take note that executing runacct without any arguments causes the process to assume that this is the first time that runacct has been run for that day. If you are attempting to restart system accounting, be sure to add the appropriate MMDD (DD = Day and MM = Month) argument on the command line.
You are now ready for startup or shutdown of the system accounting process with the following commands:
Startup: /usr/bin/su - adm -c /usr/lib/acct/startup Shutdown: /usr/bin/su - adm -c /usr/lib/acct/shutacct
You may use the following command to verify the state (on or off) of System accounting processes.
# fwtmp < /var/adm/wtmp | pg
Sample truncated output:
.telnet tn20 /dev/pts/4 1118 6 0000 0000 871178077 Sat May 10 20:54:37 1997
root tn20 pts/4 1118 7 0000 0000 871178098 Sat May 10 20:54:58 1997
acctg off 0 9 0000 0000 871179345 Sat May 10 16:10:45 1997
acctg on 0 9 0000 0000 871179352 Sat May 10 21:15:52 1997
The above example indicates where the systems administrator, started accounting (21:15:52) and shutdown accounting (16:10:45).
Most UNIX system accounting takes advantage of a hierarchical (see Figure 21.1) approach when laying out its control and data files. This allows the accounting process to maintain temporary and permanent files in logical locations. Each directory in this layer stores related groups of files, commands, or other sub-directories.
Figure 21.1.
System accounting directory structure.
According to systems documentation (HP-UX, AIX, and Solaris), the following system accounting structures are laid out as described in the following sections. Please refer to your system's documentation for more detailed information.
| /var/adm | Maintains data-collection files |
| /var/adm/acct | Directories for nite, sum and fiscal |
| /var/adm/acct/nite | Daily data and command files used by runacct |
| /var/adm/acct/sum | Summary data and command files used by runacct to produce summary reports |
| /var/adm/acct/fiscal | Summary data and command files used by monacct to produce monthly reports |
| /usr/lib/acct | System accounting commands |
| /sbin | Shell scripts rc and shutdown procedures |
| /etc/rc.config.d/acct | Set variable START_ACCT equal to 1 to activate accounting at system boot (HP-UX 10.X) |
| /etc/rc | Run command file that executes at system startup and when the system changes run state. |
Files in the /var/adm directory
| /var/adm/diskdiag | Diagnostic output during the execution of disk accounting programs |
| /var/adm/dtmp | Output from the acctdusg command |
| /var/adm/fee | Output from the chargefee command, in ASCII tacct records |
| /var/adm/pacct | Active process accounting file |
| /var/adm/wtmp | Active process accounting file |
| /var/adm/Spacct?.mmdd | Process accounting files for mmdd during the execution of runacct |
Files in the /var/adm/acct/nite Directory
| {{mmdd}} | {{mmdd}} is the month and day a file was created and is appended to the previous version of the data file. |
| active | Contains warning and error messages generated from runacct execution. |
| active{{mmdd}} | Copy of the active file after runacct encounters an error condition. |
| ctacct.{{mmdd}} | Total accounting records created from connect session accounting. |
| ctmp | Output of acctcon1. It contains a list of login sessions sorted by userid and login names. |
| Daycms | ASCII daily command summary used by prdaily. |
| daytacct | Total accounting records for current day. |
| disktacct | Total accounting records created by the dodisk command. |
| fd2log | Diagnostic output from the execution of runacct. |
| lastdate | The last day runacct was executed, in +%{{m}}%{{d}}format. |
| lock and lock1 | Used to control serial use of runacct. |
| lineuse | Terminal (tty) line usage report used by prdaily. |
| log | Diagnostics output from acctcon1. |
| log{{mmdd}} | Same as log after runacct detects an error. |
| reboots | Contains beginning and ending dates from wtmp, and a listing of reboots. |
| statefile | Used to record the current state being executed by runacct. |
| tmpwtmp | wtmp file, corrected by wtmpfix. |
| wtmperror | Error messages, if any, from wtmpfix. |
| wtmperrorr{{mmdd}} | Same as wtmperror after runacct detects an error. |
| wtmp.{{mmdd}} | The previous day's wtmp file. |
Files in the /var/adm/acct/sum Directory
| cms | Total command summary file for current month in internal summary format. |
| cmsprev | Command summary file without latest update. |
| daycms | Command summary file for previous day in internal summary format. |
| loginlog | Shows the last login date for each user. |
| rpt{{mmdd}} | Daily accounting report for date {{mmdd}}. |
| tacct | Cumulative total accounting file for current month. |
| tacctprev | Same as tacct without latest update. |
| tacct{{mmdd}} | Total accounting file for date {{mmdd}}. |
| wtmp.{{mmdd}} | Saved copy of wtmp file for date {{mmdd}}. Removed after reboot. |
Files in the /var/adm/acct/fiscal Directory
| cms{mm} | Total command summary for month {mm} in internal summary format. |
| Fiscrpt{mm} | Report similar to prdaily for the month {mm}. |
| tacct{mm} | Total accounting file for the month {mm}. |
The acctmerg command can convert records between ASCII and binary formats and merge records from different sources into a single record for each user.
After completing system accounting configuration, your system is ready to produce accounting reports. The following covers the basics of report generation for Systems Accounting.
acctcom
The acctcom utility allows you to see the accounting system data at any given time. This command may be executed from the command line with several different options. It is one of the most useful commands for getting a quick report from the system without the need to find a file.
This option will show the average statistics about processes.
$ acctcom -a
An example of a truncated listing:
COMMAND START END REAL CPU MEAN NAME USER TTYNAME TIME TIME (SECS) (SECS) SIZE(K) #accton root [Dhatch] 17:57:07 17:57:07 0.00 0.00 56.00 #acctwtmp root pts/2 17:57:07 17:57:07 0.00 0.00 60.00 #fwtmp root pts/2 17:57:07 17:57:07 0.03 0.00 160.00 #awk root pts/2 17:57:07 17:57:07 0.02 0.02 106.00 #fwtmp root pts/2 17:57:07 17:57:07 0.05 0.00 0.00 #dspmsg root pts/2 17:57:07 17:57:07 0.00 0.00 0.00 #cat root pts/2 17:57:07 17:57:07 0.00 0.00 336.00 #wtmpfix root pts/2 17:57:07 17:57:07 0.05 0.00 0.00 #dspmsg root pts/2 17:57:07 17:57:07 0.02 0.02 192.00 #acctcon1 root pts/2 17:57:08 17:57:08 0.17 0.02 96.00 #sort root pts/2 17:57:08 17:57:08 0.25 0.00 82.00 #acctcon2 root pts/2 17:57:08 17:57:08 0.05 0.00 168.00 #acctmerg root pts/2 17:57:08 17:57:08 0.05 0.00 0.00 #dspmsg root pts/2 17:57:08 17:57:08 0.00 0.00 0.00 #basename root pts/2 17:57:08 17:57:08 0.03 0.00 138.00 #sed root pts/2 17:57:08 17:57:08 0.03 0.00 136.00 #acctprc1 root pts/2 17:57:08 17:57:08 0.05 0.02 184.00 #acctprc2 root pts/2 17:57:08 17:57:08 0.05 0.00 68.00 #acctmerg root pts/2 17:57:08 17:57:08 0.02 0.00 0.00 #mv root pts/2 17:57:08 17:57:08 0.02 0.00 0.00 #acctcms root pts/2 17:57:09 17:57:09 0.02 0.00 96.00 #lsuser root pts/2 17:57:09 17:57:09 0.86 0.20 89.00 #grep root pts/2 17:57:09 17:57:09 0.86 0.00 164.00 #uniq root pts/2 17:57:10 17:57:10 0.05 0.00 0.00 #egrep root ? 17:57:22 17:57:22 0.03 0.02 114.00 . . . #tail root ? 18:23:09 18:23:09 0.05 0.00 148.00 #fgrep root ? 18:24:10 18:24:10 0.00 0.00 0.00 #egrep root ? 18:24:10 18:24:10 0.00 0.00 0.00 #acctcom root pts/2 18:24:28 18:24:28 0.39 0.27 58.00 cmds=287 Real=2.92 CPU=0.04 USER=0.01 SYS=0.03 CHAR=29767.60 BLK=0.00 USR/TOT=0.24 HOG=1.20
This option will show the amount of user time per total time (system time plus user time).
$ acctcom -r
An example of a truncated listing:
COMMAND START END REAL CPU CPU NAME USER TTYNAME TIME TIME (SECS) (SECS) FACTOR #accton root [Dhatch] 17:57:07 17:57:07 0.00 0.00 0.00 #bsh root pts/2 17:57:06 17:57:06 0.20 0.02 0.00 #mv root pts/2 17:57:07 17:57:07 0.02 0.02 0.00 #cp root pts/2 17:57:07 17:57:07 0.02 0.02 1 #acctwtmp root pts/2 17:57:07 17:57:07 0.02 0.00 0.00 #fwtmp root pts/2 17:57:07 17:57:07 0.02 0.00 0.00 #awk root pts/2 17:57:07 17:57:07 0.03 0.02 0.00 #sed root pts/2 17:57:07 17:57:07 0.03 0.00 0.00 #fwtmp root pts/2 17:57:07 17:57:07 0.08 0.02 1 #cp root pts/2 17:57:07 17:57:07 0.02 0.00 0.00 #chmod root pts/2 17:57:07 17:57:07 0.00 0.00 0.00 #chown root pts/2 17:57:07 17:57:07 0.02 0.00 0.00 #bsh root pts/2 17:57:07 17:57:07 0.08 0.02 0.00 #acctwtmp root pts/2 17:57:07 17:57:07 0.00 0.00 0.00 #fwtmp root pts/2 17:57:07 17:57:07 0.03 0.00 0.00 . . . #telnet root [Dhatch] 17:37:21 18:28:39 3078.00 2.14 0.124 #egrep root ? 18:31:47 18:31:47 0.02 0.00 0.00 #tail root ? 18:31:47 18:31:47 0.06 0.02 0.00 sendmail root ? 18:33:32 18:33:32 0.02 0.00 0.00 #acctcom root pts/2 18:33:51 18:33:51 0.47 0.36 0.304
This option will show all the processes that have been executed by the user wdwood.
$ acctcom -u wdwood
An example of a truncated listing:
COMMAND START END REAL CPU MEAN NAME USER TTYNAME TIME TIME (SECS) (SECS) SIZE(K) #accton wdwood [Dhatch] 17:57:07 17:57:07 0.00 0.00 56.00 #bsh wdwood pts/2 17:57:06 17:57:06 0.20 0.02 0.00 #mv wdwood pts/2 17:57:07 17:57:07 0.02 0.02 0.00 #cp wdwood pts/2 17:57:07 17:57:07 0.02 0.02 182.00 #acctwtmp wdwood pts/2 17:57:07 17:57:07 0.02 0.00 0.00 #fwtmp wdwood pts/2 17:57:07 17:57:07 0.02 0.00 0.00 #awk wdwood pts/2 17:57:07 17:57:07 0.03 0.02 121.00 #sed wdwood pts/2 17:57:07 17:57:07 0.03 0.00 0.00 #fwtmp wdwood pts/2 17:57:07 17:57:07 0.08 0.02 108.00 #cp wdwood pts/2 17:57:07 17:57:07 0.02 0.00 72.00 #chmod wdwood pts/2 17:57:07 17:57:07 0.00 0.00 0.00 #chown wdwood pts/2 17:57:07 17:57:07 0.02 0.00 86.00 #bsh wdwood pts/2 17:57:07 17:57:07 0.08 0.02 130.00 . . . #dspmsg wdwood pts/2 18:38:08 18:38:08 0.02 0.00 0.00 #bsh wdwood pts/2 18:38:07 18:38:08 1.08 0.02 97.00 #more wdwood pts/2 18:38:20 18:38:26 6.66 0.02 0.00 #acctcom wdwood pts/2 18:38:38 18:38:38 0.48 0.33 35.00 #cat wdwood pts/2 18:38:45 18:38:45 0.02 0.00 170.00
This option will show all the processes, for any user, running longer than 20 seconds.
$ acctcom -O 20 COMMAND START END REAL CPU MEAN NAME USER TTYNAME TIME TIME (SECS) (SECS) SIZE(K) #find wdwood [Dhatch] 18:18:43 18:19:05 22.58 6.45 30.00
To see more options for the acctcom command, or any of the system accounting commands, please refer to your man pages or system documentation manuals.
The system accounting processes generate a number of automated reports that can assist the systems administrator in viewing the daily usage of a system.
| The Daily Report | Shows the usage of ports on your system. |
| The Daily Usage | Shows the system resources used by your users during a daily period. |
| The Daily Command Summary Report | |
| The Total command Summary Report | Shows the commands run on your system and the resources those commands used. This report can be essential in helping you determine the processes that might be a potential bottleneck in your system. |
| Daily Systems Accounting Summary Report | Tells you the last time a login ID was used to access the system. This report may be used to help you identify login IDs no longer in use. |
The Daily Report The Daily Report is found in the /var/adm/acct/nite directory. It is an ASCII file called lineuse and can be viewed with any available text viewer or editor.
$ cat /var/adm/acct/nite/lineuse
Example file contents:
TOTAL DURATION: 474 MINUTES LINE MINUTES PERCENT # SESS # ON # OFF dtremote 173 36 1 1 2 lft0 0 0 0 0 1 pts/0 0 0 0 0 1 pts/1 0 0 0 0 1 pts/2 77 16 3 3 4 TOTALS 250 -- 4 4 9
The definition of each column in this report are as follows:
| LINE | The port that was used to access the system. |
| MINUTES | The number of minutes the port was active during this daily period. |
| PERCENT | The number of minutes the port was active divided by the TOTAL DURATION factor. TOTAL DURATION is the sum of the minutes the system was a multi-user run state. |
| # SESS | The number of times the port was accessed to log in to the system. |
| # ON | The number of times the port was used for login purposes. |
| # OFF | The number of logoffs handled by that port and the number of interrupts like Ctrl-c, EOF, and so on. |
The Daily Usage Report The Daily Usage Report is found in the /var/adm/acct directory. It is a binary file called daytacct that is to be accessed with the prtacct accounting command.
$ prtacct -v /var/adm/acct/nite/daytacct
Fri May 9 16:02:04 EST 1997 Page 1
LOGIN CPU CPU KCORE KCORE CONNECT CONNECT DISK FEES # OF # OF # DISK
UID NAME PRIME NPRIME PRIME NPRIME PRIME NPRIME BLOCKS PROCS SESS SAMPLES
0 TOTAL 0 0 0 0 9448 14739 0 0 0 83 0
0 japierce 0 0 0 0 8526 13904 0 0 0 46 0
0 dwilson 0 0 0 0 508 814 0 0 0 21 0
0 kvwood 0 0 0 0 412 0 0 0 0 8 0
223 wpierce 0 0 0 0 0 21 0 0 0 5 0
237 awilson 0 0 0 0 1 0 0 0 0 2 0
273 wdwood 0 0 0 0 1 0 0 0 0 1 0
The definition of each column in this report are as follows:
| UID | The user's identification number. |
| LOGIN NAME | The user's name. |
| CPU prime/non prime | The amount of time the user's program required the use of CPU. This is rounded up to the nearest minute. |
| KCORE prime/non prime | The amount of memory per minute used to run the programs. This is rounded up to the nearest kilobyte. |
| CONNECT prime/non prime | Total time the user was actually connected to the system. |
| DISK BLOCKS | The number of disk blocks used. |
| # OF PROCS | The number of processes the user executed. |
| # OF SESS | The number of sessions the user incurred by logging in. |
| # DISK SAMPLES | The number of times acctdusg or diskusg was run to cumulate the average number of DISK BLOCKS. |
| FEE | The total amount of usage charges accessed to the user for this given period. |
Daily Command Summary Report and Total Command Summary Report The Daily Command Summary Report is found in the /var/adm/acct/nite directory. It is an ASCII file called daycms and can be viewed with any available text viewer or editor.
$ cat /var/adm/acct/nite/daycms TOTAL COMMAND SUMMARY COMMAND NUMBER TOTAL TOTAL TOTAL MEAN MEAN HOG CHARS BLOCKS NAME CMDS KCOREMIN CPU-MIN REAL-MIN SIZE-K CPU-MIN FACTOR TRNSFD READ TOTALS 82 12.68 0.06 21.91 209.92 0.00 0.28 6.636e+06 0.00 man 1 7.56 0.02 1.68 440.00 0.02 1.02 5.566e+06 0.00 vi 1 2.24 0.02 0.53 121.00 0.02 3.49 71936.00 0.00 ls 5 1.15 0.01 0.02 108.15 0.00 68.33 117144.00 0.00 fgrep 14 0.39 0.00 0.01 124.17 0.00 42.86 286776.00 0.00 tail 14 0.36 0.00 0.02 126.82 0.00 18.03 142744.00 0.00 bsh 6 0.28 0.00 0.01 99.27 0.00 27.50 49410.00 0.00 ps 1 0.21 0.00 0.00 137.00 0.00 66.67 19696.00 0.00 ftpd 1 0.20 0.00 0.81 155.00 0.00 0.16 41576.00 0.00 sendmail 1 0.12 0.00 0.00 468.00 0.00 100.00 13744.00 0.00 fwtmp 3 0.07 0.00 0.00 143.00 0.00 25.00 35840.00 0.00 more 2 0.05 0.00 2.41 195.00 0.00 0.01 30144.00 0.00 pg 3 0.03 0.00 14.78 28.50 0.00 0.01 61232.00 0.00 ksh 2 0.00 0.00 0.00 0.00 0.00 0.00 18360.00 0.00 rm 6 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 accton 2 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 acctwtmp 2 0.00 0.00 0.00 0.00 0.00 0.00 128.00 0.00 egrep 14 0.00 0.00 0.00 0.00 0.00 0.00 143976.00 0.00 grep 1 0.00 0.00 0.00 0.00 0.00 0.00 23976.00 0.00 dspmsg 2 0.00 0.00 0.00 0.00 0.00 0.00 8214.00 0.00 sh 1 0.00 0.00 1.64 0.00 0.00 0.02 5058.00 0.00
The Total Command Summary Report looks like the preceding report with one exception. It is usually a monthly summary showing total accumulated since the last month or the last execution of monacct. The Total Command Summary Report is found in the /var/adm/acct/sum directory. It is an ASCII file called cms and can be viewed with any available text viewer or editor.
The definitions of each column in this report are as follows:
| COMMAND NAME | The name of the command. |
| NUMBER COMMANDS | The total number of times the command has been executed. |
| KCOREMIN | The total cumulative kilobytes segments used by the command. |
| TOTAL CPU-MIN | The total processing time in minutes. |
| REAL-MIN | The actual processing time in minutes. |
| MEAN SIZE-K | The mean of TOTAL KCOREMIN divided by execution. |
| MENU CPU-MIN | The mean of executions divided by total processing time in minutes. |
| HOG FACTOR | The total processing time divided by elapsed time. This is the utilization ratio of the system. |
| CHARS TRNSFD | The total number of reads and writes to the filesystem. |
| BLOCKS READ | The total number of physical block reads and writes. |
Daily Systems Accounting Summary Report This report is generated by the runacct command via cron. This report is found in the /var/adm/acct/sum directory and is a file whose format is rprt{MMDD}. This file is a summary report of daily activity for the system. The Daily Systems Accounting Summary Report is found in the /var/adm/acct/sum directory. It is an ASCII file and can be viewed with any available text viewer or editor. An example of this report follows:
$ cat /var/adm/acct/sum/rprt0510 Sat May 10 21:41:50 EST 1997 DAILY REPORT FOR AIX Page 1
from Sat May 10 21:27:28 EST 1997
to Sat May 10 21:41:46 EST 1997
1 openacct
1 runacct
1 acctcon1
TOTAL DURATION: 14 MINUTES
LINE MINUTES PERCENT # SESS # ON # OFF
lft0 14 100 1 1 1
pts/0 14 100 1 1 1
pts/1 14 100 1 1 1
pts/2 14 100 1 1 1
pts/3 14 100 1 1 1
TOTALS 72 -- 5 5 5
Sat May 10 21:41:50 EST 1997 DAILY USAGE REPORT FOR AIX Page 1
LOGIN CPU CPU KCORE KCORE CONNECT CONNECT DISK FEES # OF # OF # DISK
UID NAME PRIME NPRIME PRIME NPRIME PRIME NPRIME BLOCKS PROCS SESS SAMPLES
0 TOTAL 0 0 0 7 0 72 5 0 216 5 4
0 root 0 0 0 1 0 72 1 0 28 5 1
2 bin 0 0 0 0 0 0 1 0 0 0 1
4 adm 0 0 0 6 0 0 0 0 188 0 0
100 guest 0 0 0 0 0 0 1 0 0 0 1
200 servdir 0 0 0 0 0 0 2 0 0 0 1
Sat May 10 21:41:48 EST 1997 DAILY COMMAND SUMMARY Page 1
TOTAL COMMAND SUMMARY
COMMAND NUMBER TOTAL TOTAL TOTAL MEAN MEAN HOG CHARS BLOCKS
NAME CMDS KCOREMIN CPU-MIN REAL-MIN SIZE-K CPU-MIN FACTOR TRNSFD READ
TOTALS 216 6.91 0.05 7.42 132.59 0.00 0.70 1.707e+07 4094.00
diskusg 1 3.73 0.03 0.11 142.00 0.03 23.22 1.625e+07 4094.00
bsh 15 1.28 0.01 0.24 129.47 0.00 4.20 49810.00 0.00
awk 6 0.27 0.00 0.00 175.67 0.00 37.50 48971.00 0.00
ls 6 0.25 0.00 0.00 136.14 0.00 87.50 37662.00 0.00
tail 6 0.13 0.00 0.01 96.80 0.00 18.52 61176.00 0.00
sendmail 1 0.12 0.00 0.00 462.00 0.00 100.00 13744.00 0.00
dspmsg 18 0.11 0.00 0.00 212.00 0.00 33.33 74259.00 0.00
cat 17 0.11 0.00 0.00 136.00 0.00 60.00 1615.00 0.00
acctcms 4 0.10 0.00 0.00 201.00 0.00 50.00 65520.00 0.00
fgrep 6 0.09 0.00 0.00 84.25 0.00 36.36 122904.00 0.00
sort 7 0.09 0.00 0.03 112.00 0.00 3.03 15302.00 0.00
acctmerg 6 0.08 0.00 0.00 105.00 0.00 37.50 9064.00 0.00
vi 1 0.07 0.00 0.11 127.00 0.00 0.48 17912.00 0.00
egrep 6 0.06 0.00 0.00 124.00 0.00 33.33 61704.00 0.00
chown 14 0.06 0.00 0.00 48.80 0.00 35.71 15988.00 0.00
grep 3 0.06 0.00 0.01 121.00 0.00 3.70 7971.00 0.00
date 9 0.05 0.00 0.00 198.00 0.00 50.00 169.00 0.00
acctprc1 1 0.04 0.00 0.00 74.00 0.00 66.67 23672.00 0.00
acctcon1 1 0.04 0.00 0.00 142.00 0.00 50.00 7883.00 0.00
uniq 3 0.04 0.00 0.02 142.00 0.00 1.16 6269.00 0.00
ypcat 2 0.03 0.00 0.00 129.00 0.00 6.25 58000.00 0.00
more 1 0.03 0.00 6.82 101.00 0.00 0.00 11384.00 0.00
pr 5 0.02 0.00 0.00 94.00 0.00 14.29 26094.00 0.00
rm 7 0.02 0.00 0.00 82.00 0.00 9.09 5058.00 0.00
lsuser 1 0.01 0.00 0.01 19.00 0.00 7.14 4600.00 0.00
sed 7 0.00 0.00 0.01 0.00 0.00 0.00 30745.00 0.00
fwtmp 4 0.00 0.00 0.00 0.00 0.00 10.00 10270.00 0.00
getopt 3 0.00 0.00 0.00 0.00 0.00 0.00 48.00 0.00
chmod 15 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
acctwtmp 2 0.00 0.00 0.00 0.00 0.00 0.00 128.00 0.00
uname 1 0.00 0.00 0.00 0.00 0.00 0.00 4.00 0.00
wtmpfix 1 0.00 0.00 0.00 0.00 0.00 0.00 3072.00 0.00
mv 7 0.00 0.00 0.00 0.00 0.00 0.00 5058.00 0.00
acctcon2 1 0.00 0.00 0.00 0.00 0.00 100.00 660.00 0.00
accton 1 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
df 1 0.00 0.00 0.00 0.00 0.00 0.00 733.00 0.00
basename 2 0.00 0.00 0.00 0.00 0.00 0.00 23.00 0.00
expr 1 0.00 0.00 0.00 0.00 0.00 0.00 2.00 0.00
cp 19 0.00 0.00 0.00 0.00 0.00 0.00 10012.00 0.00
wc 1 0.00 0.00 0.00 0.00 0.00 0.00 1203.00 0.00
acctprc2 1 0.00 0.00 0.00 0.00 0.00 0.00 12736.00 0.00
acctdisk 1 0.00 0.00 0.00 0.00 0.00 0.00 339.00 0.00
ln 1 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
Sat May 10 21:41:48 EST 1997 MONTHLY TOTAL COMMAND SUMMARY Page 1
TOTAL COMMAND SUMMARY
COMMAND NUMBER TOTAL TOTAL TOTAL MEAN MEAN HOG CHARS BLOCKS
NAME CMDS KCOREMIN CPU-MIN REAL-MIN SIZE-K CPU-MIN FACTOR TRNSFD READ
TOTALS 1771 281.68 1.22 706.08 231.12 0.00 0.17 1.423e+08 4094.00
dtterm 2 136.19 0.24 81.83 566.58 0.12 0.29 333760.00 0.00
man 11 79.59 0.18 4.64 431.09 0.02 3.98 5.915e+07 0.00
bsh 135 7.74 0.06 13.13 124.32 0.00 0.47 705187.00 0.00
find 2 6.64 0.21 0.74 31.00 0.11 28.78 13764.00 0.00
lsuser 24 5.85 0.08 0.28 72.03 0.00 29.21 117880.00 0.00
ksh 27 4.60 0.03 189.72 178.53 0.00 0.01 637811.00 0.00
crash 1 3.89 0.02 3.19 237.00 0.02 0.51 2.635e+07 0.00
diskusg 1 3.73 0.03 0.11 142.00 0.03 23.22 1.625e+07 4094.00
acctcom 18 3.30 0.05 0.09 62.18 0.00 62.01 839000.00 0.00
telnet 2 3.25 0.05 79.10 65.62 0.02 0.06 417920.00 0.00
errpt 8 3.13 0.01 0.03 267.40 0.00 41.67 2.129e+06 0.00
telnetd 5 2.40 0.06 107.89 40.19 0.01 0.06 762960.00 0.00
tail 102 2.31 0.02 0.26 99.48 0.00 8.77 1.04e+06 0.00
fgrep 102 2.03 0.02 0.05 113.25 0.00 37.30 2.089e+06 0.00
ls 75 2.00 0.02 0.04 116.15 0.00 45.21 603775.00 0.00
vi 16 1.46 0.01 37.87 116.81 0.00 0.03 330912.00 0.00
more 35 1.21 0.01 26.19 125.30 0.00 0.04 518424.00 0.00
awk 25 0.96 0.01 0.04 175.33 0.00 14.09 141725.00 0.00
dspmsg 98 0.74 0.00 0.01 166.24 0.00 50.00 493457.00 0.00
uniq 50 0.69 0.01 0.55 115.74 0.00 1.09 142133.00 0.00
grep 33 0.59 0.00 0.30 126.22 0.00 1.54 237104.00 0.00
ps 6 0.59 0.01 0.03 86.88 0.00 25.49 104784.00 0.00
rm 75 0.59 0.01 0.04 75.23 0.00 17.75 404784.00 0.00
file 13 0.52 0.00 0.01 110.83 0.00 36.00 461053.00 0.00
sort 59 0.52 0.01 0.55 90.45 0.00 1.04 280988.00 0.00
sendmail 8 0.48 0.00 0.00 463.00 0.00 44.44 109952.00 0.00
date 96 0.46 0.00 0.01 194.89 0.00 33.33 21536.00 0.00
acctcms 15 0.42 0.00 0.01 179.22 0.00 45.00 267903.00 0.00
acctcon1 16 0.41 0.00 0.01 142.45 0.00 22.92 180989.00 0.00
egrep 102 0.40 0.00 0.02 102.33 0.00 16.13 1.049e+06 0.00
chown 49 0.38 0.01 0.01 55.54 0.00 49.06 155734.00 0.00
sh 26 0.34 0.00 4.22 131.70 0.00 0.06 156818.00 0.00
ftpd 1 0.33 0.00 57.30 212.00 0.00 0.00 184320.00 0.00
acctprc2 3 0.30 0.00 0.01 130.00 0.00 39.13 91430.00 0.00
lslpp 4 0.28 0.00 0.03 135.75 0.00 8.25 108864.00 0.00
sadc 4 0.28 0.01 0.08 24.09 0.00 13.92 2.402e+07 0.00
strings 7 0.27 0.00 0.00 95.00 0.00 61.11 76242.00 0.00
cp 84 0.26 0.00 0.02 166.67 0.00 7.79 28181.00 0.00
cat 66 0.26 0.00 0.01 163.33 0.00 27.27 93983.00 0.00
sed 44 0.25 0.00 0.28 117.75 0.00 0.74 245587.00 0.00
acctprc1 4 0.24 0.00 2.77 115.25 0.00 0.08 167963.00 0.00
mv 36 0.21 0.00 11.51 81.50 0.00 0.02 61310.00 0.00
servdir. 4 0.17 0.00 0.19 79.87 0.00 1.10 2876.00 0.00
ibm.psa 4 0.16 0.00 0.05 105.17 0.00 3.12 60576.00 0.00
termdef 8 0.14 0.00 0.00 182.00 0.00 50.00 80960.00 0.00
acctmerg 24 0.14 0.00 0.01 74.14 0.00 17.50 49956.00 0.00
chmod 65 0.13 0.00 0.00 121.50 0.00 33.33 50596.00 0.00
pr 20 0.12 0.00 0.01 155.33 0.00 6.52 83028.00 0.00
ibmelh.p 4 0.12 0.00 0.03 76.50 0.00 5.88 41760.00 0.00
uname 13 0.09 0.00 0.01 89.00 0.00 15.38 91318.00 0.00
Sat May 10 21:41:49 EST 1997 LAST LOGIN Page 1
00-00-00 guest 00-00-00 jwpierce 97-05-09 enwilson
00-00-00 lpd 97-05-09 bmwood 97-05-09 bmwood2
00-00-00 nuucp 97-05-09 sawood 97-05-10 root
00-00-00 servdir 97-05-09 tswilson
This chapter explained the basics of UNIX system accounting, provided a list of commands and their respective definitions, and supplied configuration procedures for HP-UX 10.X and IBM AIX 4.2. The system accounting directory structure was discussed, and accounting reports were defined and generated. This information may be used by a number of individuals to:
This chapter has provided basic information for the systems administrator to implement systems accounting. Used properly, the information can be of great value in helping to manage current resources in a fair manner for all users and processes. This information will also help justify, from a cost basis, future computer purchases.
©Copyright,
Macmillan Computer Publishing. All rights reserved.