extacct(5) extacct(5) NAME extacct - introduction to IRIX extended accounting features DESCRIPTION The accounting done by IRIX has traditionally been process oriented: a new accounting record is produced for each process that has been run, containing statistics about the resources used by that individual process. Although this is fine for sites with average workloads, it can be too grainy for sites that have large amounts of traffic, with the result that the accounting files quickly become too large and unmanageable. Since accounting is typically employed to charge individual projects or departments for overall resource utilization, it would often be sufficient to simply summarize the resource usage of an entire login session or batch job. This could cut down significantly on the amount of disk space required for accounting data. Therefore, IRIX provides a feature to perform accounting by array session, in which each accounting record that is written contains the accumulated statistics for all of the processes that were part of that array session. This is in addition to process-level accounting, not in place of it; the two accounting modes are separately controlled so it is possible to have either, both, or neither style of accounting enabled. The data that is collected and reported for array sessions is a superset of the data that is reported by the traditional process accounting facility. In particular, the following items are reported for array sessions but not reported by traditional process accounting: * Array session handle (see array_sessions(5)) * Service provider information (see array_sessions(5)) * Project ID (see projects(5)) * Number of swaps * Number of bytes read, number of bytes written (separately) * Number of read requests, number of write requests * Time spent waiting for block I/O * Time spent waiting for raw I/O * Time spent waiting on the run queue Some of this information would also be useful for sites that otherwise make use of process accounting. Therefore, a second type of process accounting, "extended process accounting", is provided by IRIX. Again, it is controlled separately from session accounting or traditional process accounting. IRIX writes session and extended process accounting data using the System Audit Trail (SAT) facility. This is different from traditional process accounting, which typically writes its data to the file /var/adm/pacct. Audit data is collected directly from the kernel by the satd(1M) program, then either written directly to files or else passed on to other filters or postprocessing programs. To include accounting records in the audit data, it is necessary to enable the audit events sat_proc_acct (for extended process accounting records) and/or sat_session_acct (for session accounting records). This can be done using the satconfig(1M) or sat_select(1M) commands. If the audit facility is not being used for any purpose other than accounting, no other events need to be enabled. For more information on configuring the audit facility, see the IRIX Admin: Backup, Security, and Accounting guide. Session accounting records can be written in two formats, differing only in the treatment of service provider information. In IRIX 6.4 and earlier, the service provider information for an array session was always exactly 64 bytes in length, while starting with IRIX 6.5 it could potentially vary from 0 to 1024 bytes in length. In "session accounting format 1" (the system default, and the format supported in IRIX 6.4 and earlier), exactly 64 bytes of service provider information will be reported for each array session. If in fact the array session has fewer than 64 bytes of service provider information associated with it, then it will be padded at the end with zeroes. Likewise, if it has more than 64 bytes of service provider information, the 65th and subsequent bytes will be truncated. In "session accounting format 2", the exact number of bytes of service provider information associated with the array session will be reported, along with a field specifying this length. In this case, it is possible for session accounting records to have varying lengths, but there will be no loss of data. The session accounting format can be changed dynamically by the superuser using the arsctl(2) system call or the xactl(1M) program. It can also be set for boot time be changing the kernel variable sessaf using the systune(1M) program. Note that the utility programs for traditional SVR4 process accounting (for example, acctcms, acctmerg, and turnacct) do not function with the extended process accounting or session accounting data. It is possible to convert extended accounting data into the SVR4 format (see the acctcvt(1) program for details), but the metrics that are unique to extended accounting will be lost. Software to process unmodified extended accounting data is available from independent software vendors. The format of the audit data files themselves are described in the system header files sys/sat.h and sys/extacct.h. Like any accounting or monitoring package, the extended process accounting and session accounting features do contribute to overall system overhead. For this reason, they are disabled in the kernel by default. To enable these features, use the systune(1M) program to modify either or both of these variables: do_sessacct Enables session accounting if non-zero do_extpacct Enables extended process accounting if non-zero INSTALLATION SUMMARY The following steps are required to set up session or extended process accounting: * Enable session and/or extended process accounting in the kernel by using the systune(1M) utility to set the do_sessacct and/or do_extpacct parameters to non-zero values. * Use the inst(1M) utility to install the eoe.sw.audit subsystem from your IRIX distribution media. This will add the special components required for the system audit trail facility to your system. It will be necessary to reboot the system after completing this step. * Enable the audit facility in general by using the chkconfig(1M) utility as follows: chkconfig audit on * Use the satconfig program to enable the sat_proc_acct and/or sat_session_acct audit events. If the audit facility is being used only for accounting purposes, all other events can be turned off to conserve disk space. NOTES The format of the data stream generated by the System Audit Trail facility changed between IRIX 6.2 and IRIX 6.4, then again between IRIX 6.4 and IRIX 6.5. Therefore, software that was designed to read accounting data from one of those earlier IRIX releases may not work with more recent IRIX releases (and vice versa). To help address this situation, the acctcvt(1) program can be used to convert data files or even the audit data stream (when used as a filter) from one format to another. SEE ALSO acctcvt(1), audit(1M), sat_select(1M), satconfig(1M), satd(1M), systune(1M), xactl(1M), arsctl(2), arsop(2), array_sessions(5), audit_filters(5), projects(5). IRIX Admin: Backup, Security, and Accounting Page 3