Subject : Accounting 관리

Solution Description:


	General Info
	Common problems/Tips


The following is a collection of help information for setting up and
debugging accounting problems on SunOS 4.x (Solaris 1.x). The
accounting mechanisms provided by Sunos 4.x are based upon the System V
unix, as described in the System and Network Administration - page 197
onwards. (Also in more depth in the book 'AT&T Unix system V release
4:  System Administrators Guide and 'SunOS 5.0 Administering Security,
Performance, and Accounting').  One of these references should have
been referred to before this help synthesis is used.

There are a number of problems with the accounting package provided by
SunOS 4.x that are fixed in patch id 100407-05, therefore this patch
should be applied to all SunOS 4.x systems wishing to use accounting
before attempting to set it up. Because the accounting system used in
4.x is System V based, there are few differences when migrating to
Solaris 2.0 (SunOS 5.0).

General Info

The accounting binaries are all stored in /usr/lib/acct and 
the recorded information in /var/adm/acct. There are three 
directories under /var/adm/acct:

nite   - contains all the information from the last run of runacct
         normally the previous days records.

sum    - contains the daily stored accounting records

fiscal - contains the monthly stored accounting records.

When accounting is invoked, as each process runs, the kernel accumulates
totals for the processes system time, user time, elapsed time, memory
usage in pages, chars transferred and blocks of data written or read
(equivalent of page faults). These accumulated1 totals are updated at
certain 'tick' times (normally a 1/60th sec). When the process finally
exits, the totals are written out to the file /var/adm/pacct in the
form of an acct structure (see /usr/include/sys/acct.h). The rest of
the accounting is concerned with manipulating this information along,
with the login records stored in /var/adm/wtmp, and storing this
information in daily/monthly report files (in /var/adm/acct/sum and
/var/adm/acct/fiscal directories).


Most of the problems with accounting come at the install/setup stage. The 
following five steps show how to install and verify that accounting
is working.

1. Make sure patch 100407-07 has been installed on the system.  See that
the prefixed ".FCS" on a number of files in /usr/lib/acct of this patch
has been installed.

2. After initially setting up accounting by uncomment the line in rc:

example # grep acct /etc/rc
and adding the following four lines to root crontab:

example# crontab -l
15 3 * * * find / -name .nfs\* -mtime +7 -exec rm -f {} \; -o -fstype nfs -prune
5 4 * * 6 /usr/lib/newsyslog >/dev/null 2>&1
0 * * * * /usr/lib/acct/ckpacct
0 1 * * 1-6 /usr/lib/acct/dodisk
0 2 * * 1-6 /usr/lib/acct/runacct 2> /var/adm/acct/nite/fd2log
15 5 1 * * /usr/lib/acct/monacct

Run `/usr/lib/acct/startup` to start accounting, if not
already running. Check that accounting is running by repeatedly doing
an `ls -l /var/adm/pacct`. Each time the command is run the file
should have grown by a multiple of 32 bytes, e.g:

example# ls -l /var/adm/pacct
-rw-r--r--  1 root         1120 Nov 10 18:01 /var/adm/pacct
example# ls -l /var/adm/pacct
-rw-r--r--  1 root         1152 Nov 10 18:01 /var/adm/pacct

A 32-byte accounting record is added to this file each time a
process exits.

3. Edit /etc/holidays. The first non-comment line should give the
Prime/Non-prime times for the current year. This year date is set to
1990 by default and needs updating. Calculate the dates of any holidays
to be included as nonprime time. Note that the date as given as the
number of the day in the current year (1 to 365), and not as day/month
(as suggested on page 206 System and Network administration).

4. Now check that the entries added to crontab run okay. These four commands
are all bourne shell scripts, so can be run with a debug trace.  The
best way to do this is in a window system cut and paste the commands as
listed by `crontab -l`. In the other window type "sh -x" then cut the
command from the crontab entry and paste it onto the "sh -x" and run
the command. The shell debug trace should indicate any errors. Example
traces for all four commands are given here in Appendix A.

5. If no problems occur a report file will appear in /var/adm/acct/sum
directory, e.g:

example# ls /var/adm/acct/sum
cms             daycms          rprt1026        rprt1112        tacct1026       tacct1112
cmsprev         loginlog        rprt1111        tacct           tacct1111       tacctprev

Run prdaily to view the current set of accounting results from the 
last invocation of runacct. It's generally a good idea to add 
'/usr/lib/acct' to the path of the sysadminuser to make running 
accounting commands easier. 

If all is okay, remove the current accounting night information 
and let the crontab entries collect the daily accounting information.

example# rm -f /var/adm/acct/nite/*

Common Problems/Tips

1. Restarting the runacct command.

If there are problems when running accounting, carry out the following
steps before running `runacct` again. This is because runacct will only
run once per day.

example# cd /var/adm/acct/nite
example# rm lastdate
example# rm lock*

If previous is not done, the following error will occur when running 

example# cd /var/adm/acct/nite
example# more active*
ERROR: acctg already run for Wed Nov 11 16:57:13 GMT 1992: check /var/adm/acct/nite/lastdate

2. runacct continuing previous runs

Problems can arise with accounting because runacct will try to continue
a previous aborted run when restarted. It does this by using the
information stored in /var/adm/acct/nite/statefile, when a date
argument is supplied to runacct. A space in the redirection "2>" to 
"2 >" in the crontab entry will erroneously cause this behavior. When
runacct has successfully run, the single word "COMPLETE" should appear
in the statefile.

3. pacct file not growing in size.

If thisfile is not growing in size, run startup with `sh -x
/usr/lib/acct/startup` and compare with the debug trace given in
Appendix A. Also check /var/adm/messages. Accounting will stop if the
root (/var) filesystem goes over 90% used, (as measured by `df /var`).
The following error message will appear:

Nov 11 12:48:33 skippy vmunix: Accounting suspended

When space is freed in this filesystem and goes below the 90% threshold, 
accounting will automatically start. The following message will appear 
in /var/adm/messages:

Nov 12 12:21:42 skippy vmunix: Accounting suspended

4. console appears as ? in TTYNAM output

There is a known bug (1039044) which causes the console device 
to be written as major/minor device number 1,0 in the pacct file 
rather than 0,0.To generate the name "Console" in accounting 
output do the following as root:

example# mknod /dev/Console c 1 0

Note the capital 'C' on console so as not to overwrite the 
true console device, /dev/console.

5. How is accounting information collatedon a network basis?

The accounting mechanism runs on a per machine basis and 
currently does not support the concept of network accounting. 
Write scripts to accumulate the accounting reports for several
machines on a network.

6. Mysterious uid  65535 appears in accounting reports.

This is caused by having usernames with greater than 
eight characters in the username. The user accounts used by 
C2 security ("AUpwdauthd") will cause this. Use pwck 
to check /etc/passwd for correctness and change login 
names to <=8 characters. If running C2, accept that commands run
as "AUpwdauthd" will appear under uid 65535.

7. accton: accounting is busy: cannot turn accounting ON

The above error will appear when accounting is turned on 
(/usr/lib/acct/startup) andis not configured into the 
current kernel. Check for the following line in the kernel 
config file, and make sure it is uncommented.

/sys/sun4c/conf/GENERIC:options	SYSACCT		# process acc...

The GENERIC kernel has this configured by default, whereas 
GENERIC_SMALL has it commented out.


Appendix A: Execution trace of various accounting script
            produced by setting "set -x" in the script.

example# sh -x /usr/lib/acct/startup
+ acctwtmp acctg on 
+ turnacct on 
+ remove 

example# sh -x  /usr/lib/acct/ckpacct
+ trap rm -f /var/adm/cklock*; exit 0 0 1 2 3 9 15 
+ export PATH 
+ cd /var/adm 
+ cp /dev/null cklock 
+ chmod 400 cklock 
+ ln cklock cklock1 
+ test 0 -ne 0 
+ sync 
+ sync 
+ egrep + df[0-9]  
+ awk {print $4} 
+ [ 7336 -lt 500 -a -f /tmp/acctoff ] 
+ [ 7336 -lt 500 ] 
+ [ -f /tmp/acctoff ] 
+ sed s/	.*// 
+ du -s pacct 
+ [ 500 -lt 1 ] 
+ rm -f /var/adm/cklock /var/adm/cklock1 
+ exit 0 

example# sh -x /usr/lib/acct/dodisk
+ export PATH 
+ getopts o i 
+ expr 1 - 1 
+ shift 0 
+ cd /var/adm 
+ [  =  ] 
+ [ 0 -lt 1 ] 
+ sed -n /4.2/s/\([^    ]*\)[   ].*/\1/p 
+ diskusg /dev/sd0a /dev/sd0g /dev/sd0h 
+ sort +0n +1 -o dtmp dtmp 
+ acctdisk 
+ chmod 644 disktmp 
+ chown root disktmp 
+ mv disktmp acct/nite/disktacct 

example# sh -x /usr/lib/acct/runacct 2> /usr/adm/acct/nite/fd2log
+ export PATH 
_errormsg=************ ACCT ERRORS : see  /var/adm/acct/nite/active********
+ cd /var/adm 
+ date 
+ chmod 400 /var/adm/acct/nite/lock1 
+ ln /var/adm/acct/nite/lock1 /var/adm/acct/nite/lock 
+ test 0 -ne 0 
+ egrep [0-9] 
+ df /usr 
+ awk {print $4} 
+ [ 36366 -le 500 ] 
+ cat /var/adm/acct/nite/statefile 
cat: /var/adm/acct/nite/statefile: No such file or directory
+ echo restarting acctg for 2 at  
+ logger -p daemon.err ********** SYSTEM ACCOUNTING RESTARTED  ********** 
+ [ 1 ] 
+ cat /var/adm/acct/nite/statefile 
cat: /var/adm/acct/nite/statefile: No such file or directory
+ logger -p daemon.err ************ ACCT ERRORS : see  /var/adm/acct/nite/active******** 
+ mail adm root 
+ echo ************ ACCT ERRORS : see  /var/adm/acct/nite/active******** 
+ echo ERROR: invalid state, check /var/adm/acct/nite/statefile 
+ rm -f /var/adm/acct/nite/lock /var/adm/acct/nite/lock1 
+ mv /var/adm/acct/nite/active /var/adm/acct/nite/active2 
+ exit 1 


Revision History

작성일자 : 97.03.10
작성자 : 이민호

수정일자 :
수정자 :