Maintaining Accounting Information

This section describes how to fix corrupted system accounting files and how to restart the runacct script.

Fixing Corrupted Files and wtmpx Errors

Unfortunately, system accounting is not foolproof. Occasionally, a file becomes corrupted or lost. Some files can simply be ignored or restored from backup. However, certain files must be fixed to maintain the integrity of system accounting.

The wtmpx files seem to cause the most problems in the daily operation of system accounting. When the date is changed manually and the system is in multiuser mode, a set of date change records is written to the /var/adm/wtmpx file. The wtmpfix utility is designed to adjust the time stamps in the wtmp records when a date change is encountered. However, some combinations of date changes and reboots slip through the wtmpfix utility and cause the acctcon program to fail.

How to Fix a Corrupted wtmpx File

1. Become superuser or assume an equivalent role.

   Roles contain authorizations and privileged commands. For more information about roles, see Configuring RBAC (Task Map) in System Administration Guide: Security Services.

2. Change to the /var/adm directory.
3. Convert the wtmpx file from binary format to ASCII format.

   # /usr/lib/acct/fwtmp < wtmpx > wtmpx.ascii 

4. Edit the wtmpx.ascii file to delete the corrupted records.
5. Convert the wtmpx.ascii file back to a binary file.

   # /usr/lib/acct/fwtmp -ic < wtmpx.ascii > wtmpx

   See the fwtmp(1M) man page for more information.

Fixing tacct Errors

The integrity of the /var/adm/acct/sum/tacct file is important if you are charging users for system resources. Occasionally, unusual tacct records appear with negative numbers, duplicate user IDs, or a user ID of 65535. First, check the /var/adm/acct/sum/tacctprev file by using the prtacct script to print the file. If the contents look all right, patch the latest /var/adm/acct/sum/tacctMMDD file. Then, re-create the /var/adm/acct/sum/tacct file. The following steps outline a simple patch procedure.

How to Fix tacct Errors

1. Become superuser or assume an equivalent role.

   Roles contain authorizations and privileged commands. For more information about roles, see Configuring RBAC (Task Map) in System Administration Guide: Security Services.

2. Change to the /var/adm/acct/sum directory.
3. Convert the tacctMMDD file from binary format to ASCII format.

   # /usr/lib/acct/acctmerg -v < tacctMMDD > xtacct

   MMDD is pair of two-digit numbers that represent the month and day.

4. Edit the xtacct file, removing corrupted records and writing duplicate records to another file.
5. Convert the xtacct file from ASCII format to binary format.

   # /usr/lib/acct/acctmerg -i < xtacct > tacctMMDD

6. Merge the files tacctprev and tacct.MMDD into the tacct file.

   # /usr/lib/acct/acctmerg < tacctprev tacctMMDD > tacct

Restarting the runacct Script

The runacct script can fail for several reasons.

The following are the most common reasons:

• A system crash

• The /var directory is running out of space

• A corrupted wtmpx file

If the active.MMDD file exists, check it first for error messages. If the active and lock files exist, check the fd2log file for any relevant messages.

Run without arguments, the runacct script assumes that this invocation is the first invocation of the day. The argument MMDD is necessary if the runacct script is being restarted and specifies the month and day for which the runacct script reruns the accounting. The entry point for processing is based on the contents of the statefile file. To override the statefile file, include the desired state on the command line. For a description of the available states, see the runacct(1M) man page.

---

Caution - When you run the runacct program manually, be sure to run it as user adm.

---

How to Restart the runacct Script

1. Change directories to the /var/adm/acct/nite directory.

   $ cd /var/adm/acct/nite

2. Remove the lastdate file and any lock* files, if any.

   $ rm lastdate lock*

   The lastdate file contains the date that the runacct program was last run. Restarting the runacct script in the next step re-creates this file.

3. Restart the runacct script.

   $ /usr/lib/acct/runacct MMDD [state] 2> /var/adm/acct/nite/fd2log &

   MMDD

   Is the month and day specified by two-digit numbers.

   state

   Specifies a state, or starting point, where the runacct script processing should begin.