acct(1M) acct(1M)
acct: acctdisk, acctdusg, accton, acctwtmp closewtmp, utmp2wtmp -
overview of accounting and miscellaneous accounting commands
/usr/lib/acct/acctdisk
/usr/lib/acct/acctdusg [-u file] [-p file]
/usr/lib/acct/accton [file]
/usr/lib/acct/acctwtmp "reason"
/usr/lib/acct/closewtmp
/usr/lib/acct/utmp2wtmp
Accounting software is structured as a set of tools (consisting of both C
programs and shell procedures) that can be used to build accounting
systems. acctsh(1M) describes the set of shell procedures built on top
of the C programs.
Connect-time accounting is handled by various programs that write records
into /var/adm/wtmp, as described in utmp(4). The programs described in
acctcon(1M) convert this file into session and charging records, which
are then summarized by acctmerg(1M).
Process accounting is performed by the UNIX system kernel. Upon
termination of a process, one record per process is written to a file
(normally /var/adm/pacct). The programs in acctprc(1M) summarize this
data for charging purposes; acctcms(1M) is used to summarize command
usage. Current process data can be examined using acctcom(1).
Process accounting and connect-time accounting (or any accounting records
in the tacct format described in acct(4)) can be merged and summarized
into total accounting records by acctmerg (see tacct format in acct(4)).
prtacct (see acctsh(1M)) is used to format any or all accounting records.
acctdisk reads lines that contain user ID, login name, and number of disk
blocks and converts them to total accounting records that can be merged
with other accounting records.
acctdusg reads its standard input (usually from find / -print) and
computes disk resource consumption (including indirect blocks) by login.
If -u is given, records consisting of those filenames for which acctdusg
charges no one are placed in file (a potential source for finding users
trying to avoid disk charges). If -p is given, file is the name of the
password file. This option is not needed if the password file is
/etc/passwd. (See diskusg(1M) for more details.)
accton [file] changes the state and location of kernal accounting output.
If file is given, accton directs the kernal to append the process
accounting records to file, (accton will create the file if it doesn't
already exist). accton without file turns accounting off. Although accton
may be run as root it is normally ran as adm. To change the state of
accounting adm requires the capability of CAP_ACCT_MGT and on Trusted
Page 1
acct(1M) acct(1M)
Irix systems CAP_MAC_WRITE. (see capabilities(4) ).
accton is typically ran by scripts and would not normally be run directly
by a user. If accounting is to be turned on and off manually, the script
/etc/init.d/acct start|stop should be used. /etc/init.d/acct uses su(1M)
to acquire the necessary capabilities before calling
/usr/lib/acct/startup and /usr/lib/acct/shutdown which call accton.
acctwtmp writes a utmp(4) record to its standard output. The record
contains the current time and a string of characters that describe the
reason. A record type of ACCOUNTING is assigned (see utmp(4)). reason
must be a string of 11 or fewer characters, numbers, $, or spaces. The
accounting startup and shutdown scripts /usr/lib/acct/startup and
/usr/lib/acct/shutacct use the acctwtmp command to record system startup
and shutdown events.
For each user currently logged on, closewtmp puts a false DEAD_PROCESS
record in the /var/adm/wtmp file. runacct (see runacct(1M)) uses this
false DEAD_PROCESS record so that the connect-time accounting procedures
can track the time used by users logged on before runacct was invoked.
For each user currently logged on, runacct uses utmp2wtmp to create an
entry in the file /var/adm/wtmp, created by runacct. Entries in
/var/adm/wtmp enable subsequent invocations of runacct to account for
connect times of users currently logged in.
The file /etc/config/acct controls the automatic startup and periodic
report generation of the accounting subsystem. If this file contains the
flag value on, process accounting is enabled by /etc/init.d/acct each
time the system is brought up, and nightly reports are generated and
placed in the directory /var/adm/acct/sum. chkconfig(1M) should be used
to modify the contents of the /etc/config/acct file.
The accounting software consists of accounting report generation software
with built-in tables of fixed size that might need to be increased on
larger systems. All of these programs now check the environment when
they are invoked for the requested table sizes. The accepted environment
variables are
ACCT_MAXUSERS Indicates the number of different users that can be
reported by diskusgACCT_MAXIGN Indicates the number of different filesystem names to be
ignored by diskusg(1M) in its report.
ACCT_A_SSIZE Indicates the maximum number of sessions that can be
reported by acctprc1(1M) in one accounting run.
ACCT_A_TSIZE Indicates the maximum number of login lines that can be
reported by acctcon(1M) and acctcon1(1M).
Page 2
acct(1M) acct(1M)
ACCT_A_USIZE Indicates the number of distinct login names in one
accounting run of acctprc(1M), acctprc1(1M),
acctprc2(1M), and acctcon(1M).
ACCT_CSIZE Indicates the maximum number of distinct commands in one
accounting run of acctcms(1M).
These environment variables can be specified in the accounting-related
entries of the appropriate crontab files.
/etc/passwd used for login name to user ID conversions
/usr/lib/acct holds all accounting commands listed in section 1M
of this manual
/var/adm/pacct current process accounting file
/var/adm/wtmp login/logoff history file
/etc/config/acct if it contains on, accounting runs automatically
acctcms(1M), acctcom(1), acctcon(1M), acctmerg(1M), acctprc(1M),
acctsh(1M), chkconfig(1M), diskusg(1M), fwtmp(1M), runacct(1M), acct(2),
acct(4), utmp(4).
PPPPaaaaggggeeee 3333 [ Back ]
|
