📄 unx38.htm
字号:
<HTML>
<HEAD>
<TITLE>UNIX Unleashed unx38.htm</TITLE>
<LINK REL="ToC" HREF="index.htm">
<LINK REL="Next" HREF="unx39.htm">
<LINK REL="Previous" HREF="unx37.htm"></HEAD>
<BODY TEXT="#000000" LINK="#0000FF" VLINK="#800080" bgcolor=white>
<P><A HREF="unx37.htm"><IMG SRC="bluprev.gif" WIDTH = 32 HEIGHT = 32 BORDER = 0 ALT="Previous Page"></A>
<A HREF="index.htm"><IMG SRC="blutoc.gif" WIDTH = 32 HEIGHT = 32 BORDER = 0 ALT="TOC"></A>
<A HREF="unx39.htm"><IMG SRC="blunext.gif" WIDTH = 32 HEIGHT = 32 BORDER = 0 ALT="Next Page"></A>
<A HREF="index.htm"><IMG SRC="bluprev.gif" WIDTH = 32 HEIGHT = 32 BORDER = 0 ALT="Home"></A>
</P><UL>
<LI>
<A HREF="#I1">38 — UNIX System Accounting</A></LI>
<UL>
<UL>
<UL>
<UL>
<LI>
<A HREF="#I3">By Scott Allen Parker</A></LI></UL></UL>
<LI>
<A HREF="#I4">How Does System Accounting Work?</A></LI>
<UL>
<LI>
<A HREF="#I5">At the Start</A></LI>
<UL>
<LI>
<A HREF="#I6">acctwtmp</A></LI>
<LI>
<A HREF="#I7">turnacct</A></LI>
<LI>
<A HREF="#I8">remove</A></LI></UL>
<LI>
<A HREF="#I9">Login, Run What You Will, and Logout</A></LI>
<LI>
<A HREF="#I10">System Shutdown</A></LI></UL>
<LI>
<A HREF="#I11">Setting Up and Turning On the System Accounting Option</A></LI>
<LI>
<A HREF="#I12">The Accounting System Programs</A></LI>
<UL>
<LI>
<A HREF="#I13">runacct</A></LI>
<LI>
<A HREF="#I14">dodisk</A></LI>
<LI>
<A HREF="#I15">chargefee</A></LI>
<LI>
<A HREF="#I16">monacct</A></LI>
<LI>
<A HREF="#I17">acctcom</A></LI>
<LI>
<A HREF="#I18">Daily Reports</A></LI>
<LI>
<A HREF="#I19">Daily Report</A></LI>
<LI>
<A HREF="#I20">Daily Usage Report</A></LI>
<LI>
<A HREF="#I21">Daily Command Summary Report and Total Command Summary Report</A></LI>
<LI>
<A HREF="#I22">Last Login Report</A></LI></UL>
<LI>
<A HREF="#I23">Summary</A></LI></UL></UL></UL>
<H1 ALIGN="CENTER">
<CENTER><A ID="I1" NAME="I1">
<BR>
<FONT SIZE=5><A ID="I2" NAME="I2"></A><B>38 — UNIX System Accounting</B>
<BR></FONT></A></CENTER></H1>
<H5 ALIGN="CENTER">
<CENTER><A ID="I3" NAME="I3">
<FONT SIZE=3><B>By Scott Allen Parker</B>
<BR></FONT></A></CENTER></H5>
<P>As you have learned by now, UNIX is a very complex operating system with many types of files, utilities, and programs. Your users are logging in and out, storing files, and running programs. One of the problems you may run into is keeping track of usage
of the system. UNIX system accounting was created to assist you in keeping track of your users and processes. UNIX system accounting can help you troubleshoot and tune your system performance. You can even give a value to the resources on your system. This
means that you can charge your users money or a fee for storing files and running processes. In this chapter, you will learn:
<BR></P>
<UL>
<LI>What is UNIX system accounting?
<BR>
<BR></LI>
<LI>How do I set up and turn on the system accounting option?
<BR>
<BR></LI>
<LI>How to generate report?
<BR>
<BR></LI></UL>
<H3 ALIGN="CENTER">
<CENTER><A ID="I4" NAME="I4">
<FONT SIZE=4><B>How Does System Accounting Work?</B>
<BR></FONT></A></CENTER></H3>
<P>The moment the UNIX system is up and running, the system accounting is tracking information about the system. Information is tracked until the system shutdown. The information that is tracked is as follows:
<BR></P>
<UL>
<LI>Users logging in and out of the system
<BR>
<BR></LI>
<LI>How much and many resources a user processes has taken
<BR>
<BR></LI>
<LI>How much disk space has been used by the users' files
<BR>
<BR></LI></UL>
<P>Several processes and the UNIX kernel help the system track this usage. Several of these daemons have been covered in previous chapters.
<BR></P>
<H4 ALIGN="CENTER">
<CENTER><A ID="I5" NAME="I5">
<FONT SIZE=3><B>At the Start</B>
<BR></FONT></A></CENTER></H4>
<P>When you boot the UNIX system into multiuser mode, UNIX runs a program called /usr/lib/acct/startup. startup is a shell script that runs other accounting programs and sets flags in the system to make the kernel and other processes to start recording
information. Some of the accounting programs that are run by the startup shell script are as follows:
<BR></P>
<PRE>
<BR>acctwtmp
<BR>turnacct
<BR>remove</PRE>
<P>These programs are discussed in the following sections.
<BR></P>
<H5 ALIGN="CENTER">
<CENTER><A ID="I6" NAME="I6">
<FONT SIZE=3><B>acctwtmp</B>
<BR></FONT></A></CENTER></H5>
<P>The /usr/lib/acct/acctwtmp program writes a record into the file called /var/adm/wtmp. wtmp is a key file of the accounting system, containing records about users connecting to the system, date changes, reboots, and system startup and shutdowns.
Specifically, /var/adm/wtmp has information about the following:
<BR></P>
<UL>
<LI>A user's login name
<BR>
<BR></LI>
<LI>The device the user is logging in on
<BR>
<BR></LI>
<LI>The user's process id (PID)
<BR>
<BR></LI>
<LI>How the user is logging in
<BR>
<BR></LI>
<LI>The date and time the login was made
<BR>
<BR></LI></UL>
<P>The record created by acctwtmp is a "boot" record containing the name of the system and the date and time the accounting system was started. You might see this information referred to as reasons in your man pages. In the startup and shutdown
script, you could see:
<BR></P>
<PRE>/usr/lib/acct/acctwtmp "Accounting System ON" >> /var/adm/wtmp</PRE>
<P>or
<BR></P>
<PRE>/usr/lib/acct/acctwtmp "Accounting System OFF" >> /var/adm/wtmp</PRE>
<P>If you were to list the /var/adm/wtmp file you would find entries for the two examples above. The wording might be slightly different depending upon your Operating System.
<BR></P>
<H5 ALIGN="CENTER">
<CENTER><A ID="I7" NAME="I7">
<FONT SIZE=3><B>turnacct</B>
<BR></FONT></A></CENTER></H5>
<P>The /usr/lib/acct/turnacct program turns on the accounting system. If you look inside the startup shell script, you will see the line containing:
<BR></P>
<PRE>/usr/lib/acct/turnacct on</PRE>
<P>This program will run a special process called accton.
<BR></P>
<PRE>/usr/lib/acct/accton /var/adm/pacct</PRE>
<P>/var/adm/pacct has information about processes that are running the system. Specifically, /var/adm/pacct has information about the following:
<BR></P>
<UL>
<LI>Who is using the process
<BR>
<BR></LI>
<LI>Group ID's of users using the process
<BR>
<BR></LI>
<LI>The start and elapsed time of the process
<BR>
<BR></LI>
<LI>The CPU timed used
<BR>
<BR></LI>
<LI>The memory used
<BR>
<BR></LI>
<LI>The commands run
<BR>
<BR></LI>
<LI>The tty used to run or use the process.
<BR>
<BR></LI></UL>
<HR ALIGN=CENTER>
<NOTE>
<IMG SRC="note.gif" WIDTH = 35 HEIGHT = 35><B>NOTE:</B> You will find a number of /var/adm/pacct files on your system over a period time. The reason for this is that UNIX runs a program called /usr/lib/acct/ckpacct. ckpacct will be discussed later in this
chapter, but for now suffice it to say that ckpacct checks the /var/adm/pacct for its size. If the /var/adm/pacct file is more than 500 blocks, ckpacct runs turnacct to move the current pacct file to /var/adm/pacct with an incremented version number
attached. For instance, /var/adm/pacct would be moved to the free name in /var/adm/pacct<I>#</I> (where <I>#</I> starts with the number 1 and is incremented by one every time an additional /var/adm/pacct is needed). The next time ckpacct runs turnacct, it
will move the /var/adm/pacct file to /var/adm/pacct1, and so on. This increment insures that the /var/adm/pacct file is kept in sequence and never overwritten.
<BR></NOTE>
<HR ALIGN=CENTER>
<H5 ALIGN="CENTER">
<CENTER><A ID="I8" NAME="I8">
<FONT SIZE=3><B>remove</B>
<BR></FONT></A></CENTER></H5>
<P>/usr/lib/acct/remove will wipe out the /var/adm/acct/sum/pacct and /var/adm/acct/sum/wtmp files. The /var/adm/acct/sum directory contains accumulated summary files for most of the daily files tracked by the accounting system. You wouldn't want the file
to remain between "reboots" of the accounting system or even the operating system. These files are relevant only from one boot of the accounting system to the next. We will discuss the /var/adm/acct directory later in this chapter.
<BR></P>
<H4 ALIGN="CENTER">
<CENTER><A ID="I9" NAME="I9">
<FONT SIZE=3><B>Login, Run What You Will, and Logout</B>
<BR></FONT></A></CENTER></H4>
<P>In a matter of minutes after the system comes up in multiuser mode, someone logs onto the system. No need to fear: the login and init programs are ready for them. login and init record the user's session by adding a record to the /var/adm/wtmp file.
Next, the user runs a process, and the UNIX kernel monitors the process and writes a record about this to the /var/adm/pacct file.
<BR></P>
<P>There are other programs that help the accounting periodically. The /usr/lib/acct/ckpacct file, which checks /var/adm/pacct for its size, is run every hour. The ckpacct shell script runs
<BR></P>
<PRE>/usr/lib/acct/turnacct switch</PRE>
<P>to switch the current /var/adm/pacct to an archived file with a version number such as /var/adm/pacct1, /var/adm/pacct2, and so on. These archives will become important when you are recovering from a failure to process these files.
<BR></P>
<P>On a daily basis, the /usr/lib/acct/runacct program is run to create daily and cumulative totals for connections, fees, disk storage, and processes. You will learn more about runacct later in this chapter.
<BR></P>
<H4 ALIGN="CENTER">
<CENTER><A ID="I10" NAME="I10">
<FONT SIZE=3><B>System Shutdown</B>
<BR></FONT></A></CENTER></H4>
<P>When the UNIX system is shut down, the shutdown utility invokes several shell scripts found in the /sbin/rc0.d directory. One of the shells, called k22acct, runs the utility
<BR></P>
<PRE>/usr/lib/acct/shutacct</PRE>
<P>which will write a record into /var/adm/wtmp. The record is called the "reason" record. After this reason is written, the accounting system is then shutdown. Then the shutdown program finishes the system shutdown. See Chapter 34,
"Starting Up and Shutting Down," for more information about the shutdown program.
<BR></P>
<H3 ALIGN="CENTER">
<CENTER><A ID="I11" NAME="I11">
<FONT SIZE=4><B>Setting Up and Turning On the System Accounting Option</B>
<BR></FONT></A></CENTER></H3>
<P>There are several things that you need to brush up on before starting the accounting system. The /sbin contains directories that the boot and the shutdown program use. We are concerned with only three of these directories.
<BR></P>
<TABLE BORDER>
<TR>
<TD>
<P>/etc/rc0.d</P>
<TD>
<P>Contains the scripts that are executed during the shutdown process</P>
<TR>
<TD>
<P>/etc/rc2.d</P>
<TD>
<P>Contains the scripts that are executed during the boot process to multiuser mode</P>
<TR>
<TD>
<P>/sbin/init.d/acct</P>
<TD>
<P>Contains the programs (links to shell scripts) that are executed as the UNIX system is being initialized</P></TABLE>
<P>The /etc/rc0.d/K22acct is a shell script that shuts the accounting system down when the system is shutting down. The /etc/rc2.d/S22acct is the shell script that turns on the accounting system. Here is what you do to set up these files:
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -