System V Accounting Accounting

The aforementioned command sa includes a number of options; this is a versatile program that can process recorded accounting data in a number of ways. For the proper use of the sa command, the existing manual pages should be consulted. Another useful tool is the ac program, which reports on user contact time. It relays data in the file usradmwtmp, containing records on users logins and logouts. The ac program also provides a number of options.

7.4.2 System V Accounting

The System V accounting subsystem is more powerful and versatile than the BSD one. System V uses an automated accounting system, and it includes a suite of commands, shell scripts, and C programs designed for accounting purposes; together they offer a great deal of flexibility. We briefly describe how System V accounting works. As is common for accounting, the related directories are usradm or varadm; and, as is common for System V, there is a dedicated directory hierarchy structure starting with usradmacct instead of the individual files typical in BSD. Three additional subdirectories are fiscal, nite, and sum. The three directories provide: usradmacctfiscal Keeps reports by fiscal period usually monthly and old binary fiscal period summary files usradmacctnite Keeps daily binary summary files; daily process accounting records; raw disk accounting records; and status, error log, and lock files usradmacctsum Keeps daily binary and current fiscal period cumulative summary files and daily reports Several other files are of special interest: varadmpacct Previously described binary data file in which the kernel writes raw data varadmacctwtmp Previously described binary log file that records each login and logout attempt A raw disk usage data file 185 varadmfee A file to store additional charge records specified by the administrator, using the chargefee command; these are extra charges for special services not covered by the accounting system A simplified flow chart of processed data in the System V accounting subsystem is presented in Figure 7.1. Figure 7.1: System V accounting subsystem. The kernel some of the available commands could also be used enters initial data in the raw data files; these data are then processed by a series of utilities, producing several intermediate binary 186 ls −C usrlibacct Solaris 2.x acctcms acctmerg chargefee monacct ptelus.awk utmp2wtmp acctcon accton ckpacct nulladm remove wtmpfix acctcon1 acctprc closewtmp prctmp runacct acctcon2 acctprc1 dodisk prdaily shutacct acctdisk acctprc2 fwtmp prtacct startup acctdusg acctwtmp lastlogin ptecms.awk turnacct Daily and cumulative summary files, as well as report files, are specified by the corresponding self−explanatory names; in the case of report files, ddmm corresponds to the date day and month. The last step is to enable the accounting subsystem. This means the accounting should start at the system booting. The administrator performs the following steps to enable accounting in Linux there is one more directory level etcrc.d: Checks the rc startstop script acct for the accounting subsystem in the etcinitd.d directory, and creates the file if it does not exist • Creates the symbolic link in the etcrc2.d directory assuming the run level 2 corresponds to the multi−user mode: etcrc2.dS22acct − etcinit.dacct. The startup script should initiate accounting • Creates the symbolic link in the etcrc0.d directory: etcrc0.dK22acct − etcinit.dacct. The stop script should invoke the shutacct command to shutdown accounting • Adds the necessary crontab entries for various accounting utilities for the users adm and root often, these entries already exist, and will only need to be activated • Once these steps are completed, the accounting subsystem will start at the system booting. For a better understanding of the startstop procedure, the previously mentioned script files for Solaris 2.x flavor are presented here in part. cat etcinit.dacct sbinsh Copyright c ATT All Rights Reserved state=1 ..... ..... case state in start ..... ..... echo Starting process accounting usrlibacctstartup ;; stop echo Stopping process accounting usrlibacctshutacct ;; esac 187 cat usrlibacctstartup sbinsh Copyright c ATT All Rights Reserved startup acct− should be called from etcrc whenever system is brought up PATH=usrlibacct:usrbin:usrsbin acctwtmp acctg on varadmwtmp turnacct switch clean up yesterdays accounting files rm −f varadmacctsumwtmp rm −f varadmacctsumpacct rm −f varadmacctnitelock Solaris provides the turnacct command to start or stop accounting, depending on the attached argument. This command replaces the BSD accton command. The script to shutdown accounting is: cat usrlibacctshutacct sbinsh Copyright c ATT All Rights Reserved shutacct [arg] − shuts down acct, called from usrsbinshutdown whenever system is taken down arg added to varwtmp to record reason, defaults to shutdown PATH=usrlibacct:usrbin:usrsbin _reason={1−acctg off} acctwtmp {_reason} varadmwtmp turnacct off

7.4.3 AIX−Flavored Accounting