NAME

acct:  acctdisk, acctdusg, accton, acctwtmp closewtmp, utmp2wtmp − overview of accounting and miscellaneous accounting commands

SYNOPSIS

/usr/lib/acct/acctdisk

/usr/lib/acct/acctdusg [−u file] [−p file]

/usr/lib/acct/accton [file]

/usr/lib/acct/acctwtmp "reason"

/usr/lib/acct/closewtmp

/usr/lib/acct/utmp2wtmp

DESCRIPTION

Accounting software is structured as a set of tools (consisting of both C programs and shell procedures) that can be used to build accounting systems.  acctsh(1M) describes the set of shell procedures built on top of the C programs. 

Connect time accounting is handled by various programs that write records into /var/adm/wtmp, as described in utmp(4).  The programs described in acctcon(1M) convert this file into session and charging records, which are then summarized by acctmerg(1M). 

Process accounting is performed by the UNIX system kernel.  Upon termination of a process, one record per process is written to a file (normally /var/adm/pacct).  The programs in acctprc(1M) summarize this data for charging purposes; acctcms(1M) is used to summarize command usage.  Current process data may be examined using acctcom(1). 

Process accounting and connect time accounting (or any accounting records in the tacct format described in acct(4)) can be merged and summarized into total accounting records by acctmerg (see tacct format in acct(4)).  prtacct (see acctsh(1M)) is used to format any or all accounting records. 

acctdisk reads lines that contain user ID, login name, and number of disk blocks and converts them to total accounting records that can be merged with other accounting records. 

acctdusg reads its standard input (usually from find / −print) and computes disk resource consumption (including indirect blocks) by login.  If −u is given, records consisting of those filenames for which acctdusg charges no one are placed in file (a potential source for finding users trying to avoid disk charges).  If −p is given, file is the name of the password file.  This option is not needed if the password file is /etc/passwd.  (See diskusg(1M) for more details.) 

accton alone turns process accounting off.  If file is given, it must be the name of an existing file, to which the kernel appends process accounting records (see acct(2) and acct(4)). 

acctwtmp writes a utmp(4) record to its standard output.  The record contains the current time and a string of characters that describe the reason. A record type of ACCOUNTING is assigned (see utmp(4)).  reason must be a string of 11 or fewer characters, numbers, $, or spaces.  For example, the following are suggestions for use in reboot and shutdown procedures, respectively:

acctwtmp "acctg on" >> /var/adm/wtmp
acctwtmp "acctg off" >> /var/adm/wtmp

For each user currently logged on, closewtmp puts a false DEAD_PROCESS record in the /var/adm/wtmp file.  runacct (see runacct(1M)) uses this false DEAD_PROCESS record so that the connect accounting procedures can track the time used by users logged on before runacct was invoked. 

For each user currently logged on, runacct uses utmp2wtmp to create an entry in the file /var/adm/wtmp, created by runacct.  Entries in /var/adm/wtmp enable subsequent invocations of runacct to account for connect times of users currently logged in. 

FILES

/etc/passwdused for login name to user ID conversions
/usr/lib/acctholds all accounting commands listed in
sub-class 1M of this manual
/var/adm/pacctcurrent process accounting file
/var/adm/wtmplogin/logoff history file

SEE ALSO

acctcms(1M), acctcom(1), acctcon(1M), acctmerg(1M), acctprc(1M), acctsh(1M), diskusg(1M), fwtmp(1M), runacct(1M), acct(2), acct(4), utmp(4). 

  —  Job Accounting Utilities