These records (produced from the output of system programs such as date, init, login, ttymon, and acctwtmp) are stored in the /var/adm/wtmpx file. Entries in the wtmpx file can contain the following information:

• Login name

• Device name

• Process ID

• Entry type

• Time stamp that denotes when the entry was made.

Process Accounting

Process accounting enables you to keep track of the following data about each process that runs on your system:

• User IDs and group IDs of users using the process

• Beginning times and elapsed times of the process

• CPU time for the process (user time and system time)

• Amount of memory used

• Commands run

• The tty controlling the process

Every time a process terminates, the exit program collects this information and writes it to the /var/adm/pacct file.

Disk Accounting

Disk accounting enables you to gather and format the following data about the files each user has on disks:

• User name and user ID of the user

• Number of blocks used by the user's files

This data is collected by the /usr/lib/acct/dodisk shell script at intervals determined by the entry you add to the /var/spool/cron/crontabs/root file. In turn, the dodisk script invokes the acctdisk and acctdusg commands, which gather disk usage by login.

Caution - Information gathered by running the dodisk script is stored in the /var/adm/acct/nite/disktacct file. This information is overwritten the next time the dodisk script is run. Therefore, avoid running the dodisk script twice in the same day.

The acctdusg command might overcharge for files that are written randomly, which can create holes in the files. This problem occurs because the acctdusg command does not read the indirect blocks of a file when determining the file size. Rather, the acctdusg command determines the file size by checking the di_size value of the inode.

Calculating User Fees

The chargefee utility stores charges for special services provided to a user, such as file restoration, in the /var/adm/fee file. Each entry in the file consists of a user login name, user ID, and the fee. This file is checked by the runacct script every day and new entries are merged into the accounting records. For instructions on running the chargefee script to bill users, see How to Bill Users.

How Daily Accounting Works

Here is a step-by-step summary of how daily accounting works:

1. When the system is switched into multiuser mode, the /usr/lib/acct/startup program is executed. The startup program executes several other programs that invoke daily accounting.

2. The acctwtmp program adds a "boot" record to the /var/adm/wtmpx file. In this record, the system name is shown as the user name in the wtmpx record. The following table summarizes how the raw accounting data is gathered and where it is stored.

   Table 19-1 Raw Accounting Data

   File in /var/adm	Information Stored	Written By	Format
   wtmpx	Connect sessions	login, init	binary
   	Changes	date
   	Reboots	acctwtmp
   	Shutdowns	shutacct
   pacctn	Processes	Kernel (when the process ends)	binary
   		turnacct switch (which creates a new file when the old one reaches 500 blocks)
   fee	Special charges	chargefee	ASCII
   acct/nite/disktacct	Disk space used	dodisk	binary

3. The turnacct script, invoked with the -on option, begins process accounting. Specifically, the turnacct script executes the accton program with the /var/adm/pacct argument.

4. The remove shell script "cleans up" the saved pacct and wtmpx files left in the sum directory by the runacct script.

5. The login and init programs record connect sessions by writing records into the /var/adm/wtmpx file. Date changes (using date with an argument) are also written to the /var/adm/wtmpx file. Reboots and shutdowns using the acctwtmp command are also recorded in the /var/adm/wtmpx the.

6. When a process ends, the kernel writes one record per process, using the acct.h format, in the /var/adm/pacct file.

   Every hour, the cron command executes the ckpacct script to check the size of the /var/adm/pacct file. If the file grows past 500 blocks (default), the turnacct switch command is executed. (The program moves the pacct file to the pacctn file and creates a new one.) The advantage of having several smaller pacct files becomes apparent when you try to restart the runacct script if a failure occurs when processing these records.

7. The runacct script is executed by the cron command each night. The runacct script processes the accounting files: /var/adm/pacctn, /var/adm/wtmpx, /var/adm/fee, and /var/adm/acct/nite/disktacct, to produce command summaries and usage summaries by user name.

8. The /usr/lib/acct/prdaily script is executed on a daily basis by the runacct script to write the daily accounting information in the /var/adm/acct/sum/rprtMMDD files.

9. The monacct script should be executed on a monthly basis (or at intervals you determine, such as the end of every fiscal period). The monacct script creates a report based on data stored in the sum directory that has been updated daily by the runacct script. After creating the report, the monacct script "cleans up" the sum directory to prepare the directory's files for the new runacct data.

What Happens if the System Shuts Down

If the system is shut down using the shutdown command, the shutacct script is executed automatically. The shutacct script writes a reason record into the /var/adm/wtmpx file and turns off process accounting.