Wednesday, July 14, 2010
acct: Unix System Accounting Enabled Pt 3
Upon the completion of a successful execution of runacct, several reports and binary data files are created and several raw data files are removed. The following is a brief description of the action performed in each runacct state.
Table 1 provides the following information in tabular format. The CONNECT state creates lineuse, reboots, and ctacct files from the wtmp file.
The lineuse and reboots files provide the history of login connections and system reboots, respectively.
The ctacct file contains this login and reboot information in total accounting (tacct) format.
The PROCESS state creates the ptacct total accounting file from the process accounting data (pacct* files). The total accounting file generated in this state is a summary by user of pacct data.
The MERGE state combines the ptacct and ctacct files to create the daytacct total accounting file which contains all of the accounting data available in summarized form. (Files in tacct format can be processed by the acctmerg command.) If the system administrator has configured fee and disk accounting then these files will be processed into the daytacct total accounting file by the FEE and DISK states.
The MERGETACCT state processes the current days total accounting data into another tacct file called /var/adm/acct/sum/tacct.MMDD (where MMDD is the month and day of the accounting run).
This tacct file is a running total of all daily tacct files which will be used by the monthly accounting script monacct. The CMS state uses the acctcms command to summarize the process accounting data by command into cms files. One file is this data in binary format and the other is in ascii format.
The CMS state also creates the last login report by using the lastlogin command which shows the last time a user logged in.
The USEREXIT state will run the /usr/lib/acct/runacct.local script if it exists and has a size greater than zero. An example USEREXIT script is given in Listing 1.
The CLEANUP state generates the final report using the prdaily report, removes all unnecessary data files, removes the lock files, reports the completion of the accounting run, and terminates.
Labels:
Accounting,
Audit,
Security
No comments:
Post a Comment