Setting Up Accounting

You can set up system accounting to run while the system is in multiuser mode (system state 2). Generally, this involves creating the /etc/rc0.d/K22acct and /etc/rc2.d/S22acct files, and modifying the

/var/spool/cron/crontabs/adm and
/var/spool/cron/crontabs/root files.

Most of the cron entries needed for accounting are put into the /var/spool/cron/crontabs/adm database file. The sample entries there run ckpacct periodically, runacct daily, and monacct on a fiscal basis; you can change these defaults. After these entries have been added to the database and the accounting programs have been installed, accounting should run automatically.

Another feature offered by Solaris accounting facilities is the chargefee utility, which stores charges for special services provided to a user, such as file restoration, in the file /var/adm/acct/fee.

The runacct Program

The main daily accounting shell script, runacct, is normally invoked by cron outside of prime time hours. The runacct shell script processes connect, fee, disk, and process accounting files. It also prepares daily and cumulative summary files for use by prdaily and monacct for billing purposes.

The runacct shell script takes care not to damage files if errors occur. A series of protection mechanisms are used that attempt to recognize an error, provide intelligent diagnostics, and complete processing in such a way that runacct can be restarted with minimal intervention. It records its progress by writing descriptive messages into the file active. (Files used by runacct are assumed to be in the /var/adm/acct/nite directory, unless otherwise noted.) All diagnostic output during the execution of runacct is written into fd2log.

When runacct is invoked, it creates the files lock and lock1. These files are used to prevent simultaneous execution of runacct. The runacct program prints an error message if these files exist when it is invoked. The lastdate file contains the month and day runacct was last invoked, and is used to prevent more than one execution per day. If runacct detects an error, a

message is written to the console, mail is sent to root and adm, locks are removed, diagnostic files are saved, and execution is ended. For instructions on how to start runacct again, see "How to Restart runacct" on page 1341.

To allow runacct to be restartable, processing is broken down into separate re-entrant states. The file statefile is used to keep track of the last state completed. When each state is completed, statefile is updated to reflect the next state. After processing for the state is complete, statefile is read and the next state is processed. When runacct reaches the CLEANUP state, it removes the locks and ends. States are executed as shown in Table 67-1:

Table 67-1 runacct

State	Description
SETUP	The command turnacct switch is executed to create a new pacct file. The process accounting files in /var/adm/pacctn (except for the pacct file) are moved to /var/adm/Spacctn.MMDD. The /var/adm/wtmp file is moved to /var/adm/acct/nite/wtmp.MMDD (with the current time record added on the end) and a new /var/adm/wtmp is created. closewtmp and utmp2wtmp add records to wtmp.MMDD and the new wtmp to account for users currently logged in.
WTMPFIX	The wtmpfix program checks the wtmp.MMDD file in the nite directory for accuracy. Because some date changes will cause acctcon to fail, wtmpfix attempts to adjust the time stamps in the wtmp file if a record of a date change appears. It also deletes any corrupted entries from the wtmp file. The fixed version of wtmp.MMDD is written to tmpwtmp.
CONNECT	The acctcon program is used to record connect accounting records in the file ctacct.MMDD. These records are in tacct.h format. In addition, acctcon creates the lineuse and reboots files. The reboots file records all the boot records found in the wtmp file.
PROCESS	The acctprc program is used to convert the process accounting files, /var/adm/Spacctn.MMDD, into total accounting records in ptacctn.MMDD. The Spacct and ptacct files are correlated by number so that if runacct fails, the Spacct files will not be processed.
MERGE	The MERGE program merges the process accounting records with the connect accounting records to form daytacct.

Table 67-1 runacct(Continued)

State	Description
FEES	The MERGE program merges ASCII tacct records from the fee file into daytacct.
DISK	If the dodisk procedure has been run, producing the file disktacct, the DISK program merges the file into daytacct and move disktacct to /tmp/disktacct.MMDD.
MERGETACCT	The MERGETACCT merges daytacct with sum/tacct, the cumulative total accounting file. Each day, daytacct is saved in sum/tacct.MMDD, so that sum/tacct can be re-created if it is corrupted or lost.
CMS	The program acctcms is run several times. acctcms is first run to generate the command summary using the Spacctn files and write it to sum/daycms. The acctcms program is then run to merge sum/daycms with the cumulative command summary file sum/cms. Finally, acctcms is run to produce the ASCII command summary files, nite/daycms and nite/cms, from the files sum/daycms and sum/cms, respectively. The program lastlogin is used to create the log file /var/adm/acct/sum/loginlog, the report of when each user last logged in. (If runacct is run after midnight, the dates showing the time last logged in by some users will be incorrect by one day.)
USEREXIT	Any installation-dependent (local) accounting program can be included at this point. runacct expects it to be called /usr/lib/acct/runacct.local.
CLEANUP	Cleans up temporary files, runs prdaily and saves its output in sum/rpt.MMDD, removes the locks, then exits.

---

Caution - When restarting runacct in the CLEANUP state, remove the last ptacct file because it will not be complete.

---

Files Produced by runacct

The most useful files produced by runacct (found in /var/adm/acct) are shown in Table 67-2.

Table 67-2 runacct

File	Description
nite/lineuse	runacct calls acctcon to gather data on terminal line usage from /var/adm/acct/nite/tmpwtmp and writes the data to /var/adm/acct/nite/lineuse. prdaily uses this data to report line usage. This report is especially useful for detecting bad lines. If the ratio between the number of logouts to logins is greater than about three to one, there is a good possibility that the line is failing.
nite/daytacct	This file is the total accounting file for the day in tacct.h format.
sum/tacct	This file is the accumulation of each day's nite/daytacct and can be used for billing purposes. It is restarted each month or fiscal period by the monacct procedure.
sum/daycms	runacct calls acctcms to process the data about the commands used during the day. This information is stored in /var/adm/acct/sum/daycms. It contains the daily command summary. The ASCII version of this file is /var/adm/acct/nite/daycms.
sum/cms	This file is the accumulation of each day's command summaries. It is restarted by the execution of monacct. The ASCII version is nite/cms.
sum/loginlog	runacct calls lastlogin to update the last date logged in for the logins in /var/adm/acct/sum/loginlog. lastlogin also removes from this file logins that are no longer valid.
sum/rprt.MMDD	Each execution of runacct saves a copy of the daily report that was printed by prdaily.

· How to Set Up Accounting

1. Become root.

2. If necessary, install the SUNWaccr and SUNWaccu packages on your system by using the pkgadd or swmtool command.

3. Install /etc/init.d/acct as the start script in Run Level 2.

# ln /etc/init.d/acct /etc/rc2.d/S22acct

4. Install /etc/init.d/acct as the stop script in Run Level 0.

# ln /etc/init.d/acct /etc/rc0.d/K22acct

5. Add entries for /usr/lib/acct/ckpacct, /usr/lib/acct/runacct, and /usr/lib/acct/monacct to the end of /var/spool/cron/crontabs/adm, by using the editor of your choice.

6. Add an entry for /usr/lib/acct/dodisk to the end of /var/spool/cron/crontabs/root by using the editor of your choice.

7. Edit /etc/acct/holidays to include national and local holidays, by using the editor of your choice.

Examples--Setting Up Accounting

The following example shows how the crontab entries that run /usr/lib/acct/ckpacct, /usr/lib/acct/runacct, and /usr/lib/acct/monacct have been added to /var/spool/cron/crontabs/adm.

#ident "@(#)adm 1.5 92/07/14 SMI" /* SVr4.0 1.2 */ # # The adm crontab file should contain startup of performance collection if # the profiling and performance feature has been installed. # 0 * * * * /usr/lib/acct/ckpacct 30 2 * * * /usr/lib/acct/runacct 2> /var/adm/acct/nite/fd2log 30 7 1 * * /usr/lib/acct/monacct

The following example shows how the crontab entry that runs /usr/lib/acct/dodisk has been added to /var/spool/cron/crontabs/root.

#ident "@(#)root 1.12 94/03/24 SMI" /* SVr4.0 1.1.3.1 */ # # The root crontab should be used to perform accounting data collection. # # The rtc command is run to adjust the real time clock if and when # daylight savings time changes. # 0 2 * * 0,4 /etc/cron.d/logchecker 5 4 * * 6 /usr/lib/newsyslog 15 3 * * * /usr/lib/fs/nfs/nfsfind 1 2 * * * [ -x /usr/sbin/rtc ] && /usr/sbin/rtc -c > /dev/null 2>&1 30 22 * * 4 /usr/lib/acct/dodisk

The following example shows a sample /etc/acct/holidays file.

* @(#)holidays 2.0 of 1/1/89 * Prime/Nonprime Table for UNIX Accounting System * * Curr Prime Non-Prime * Year Start Start * 1989 0800 1800 * * only the first column (month/day) is significiant. * * month/day Company * Holiday * 1/1 New Years Day 5/30 Memorial Day 7/4 Indep. Day 9/5 Labor Day 11/24 Thanksgiving 11/25 day after 12/25 Christmas 12/26 PDO after Christmas

· How to Bill Users

1. Become root.

2. Set up your system to charge for services provided to a user by using the

   chargefee command, which records charges in the file /var/adm/fee.

# chargefee username amount

In this command,

username	Is the user account you want to bill.
amount	Is the number of units to bill the user.

Example--Billing Users

The following example charges 10 units each time a user logs in to the account print_customer.

# chargefee print_customer 10

Maintaining Accounting

· How to Fix a wtmp File

1. Change to the /var/adm/acct/nite directory.

2. Convert the binary file wtmp.MMDD into the ASCII file xwtmp.

$ fwtmp wtmp.MMDD xwtmp

In this command,

MMDD.......Is a pair of two-digit numbers representing the month and day.

3. Edit xwtmp. Delete the corrupted files, or delete all records from the beginning up to the date change.

4. Convert the ASCII file xwtmp to a binary file, overwriting the corrupted file.

$ fwtmp -ic xwtmp wtmp.MMDD

· How to Fix tacct Errors

1. Change to the /var/adm/acct/sum directory.

2. Convert the contents of tacct.MMDD from binary to ASCII format.

$ acctmerg -v tacct.MMDD xtacct

In this command,

MMDD.......Is the month and day specified by two-digit numbers.

3. Edit the xtacct file, removing bad records and writing duplicate records to another file.

4. Convert the xtacct file from ASCII format to binary.

$ acctmerg -i xtacct tacct.MMDD

In this command,

MMDD.......Is the month and day specified by two-digit numbers.

5. Merge the files tacct.prv and tacct.MMDD into the file tacct.

$ acctmerg tacctprv tacct.MMDD tacct

· How to Restart runacct

The runacct procedure can fail for a variety of reasons, the most common being a system crash, /var running out of space, or a corrupted wtmp file. If the active.MMDD file exists, check it first for error messages. If the active and lock files exist, check fd2log for any mysterious messages.

Called without arguments, runacct assumes that this is the first invocation of the day. The argument MMDD is necessary if runacct is being restarted and specifies the month and day for which runacct will rerun the accounting. The entry point for processing is based on the contents of statefile. To override statefile, include the desired state on the command line.

$ runacct [MMDD [state]]

In this command,

MMDD	Is the month and day specified by two-digit numbers.
state	Specifies a state, or starting point, where runacct processing should begin.