This section describes how to fix corrupted system accounting files and how to restart the runacct script.
Unfortunately, system accounting is not foolproof. Occasionally, a file becomes corrupted or lost. Some files can simply be ignored or restored from backup. However, certain files must be fixed to maintain the integrity of system accounting.
The wtmpx files seem to cause the most problems
in the daily operation of system accounting. When the date is changed manually
and the system is in multiuser mode, a set of date change records is written
to the /var/adm/wtmpx file. The wtmpfix utility
is designed to adjust the time stamps in the wtmp records
when a date change is encountered. However, some combinations of date changes
and reboots slip through the wtmpfix utility and cause
the acctcon program to fail.
How to Fix a Corrupted wtmpx File
Become superuser or assume an equivalent role.
Roles contain authorizations and privileged commands. For more information about roles, see Configuring RBAC (Task Map) in System Administration Guide: Security Services .
Change to the /var/adm directory.
Convert the wtmpx file
from binary format to ASCII format.
# /usr/lib/acct/fwtmp < wtmpx > wtmpx.ascii
Edit the wtmpx.ascii file
to delete the corrupted records.
Convert the wtmpx.ascii file back to a binary
file.
# /usr/lib/acct/fwtmp -ic < wtmpx.ascii > wtmpx
See the fwtmp ( 1M ) man page for more information.
The integrity of the /var/adm/acct/sum/tacct file
is important if you are charging users for system resources. Occasionally,
unusual tacct records appear with negative numbers, duplicate
user IDs, or a user ID of 65535. First, check the /var/adm/acct/sum/tacctprev file by using the prtacct script to print the
file. If the contents look all right, patch the latest /var/adm/acct/sum/tacct
MMDD file. Then, re-create the /var/adm/acct/sum/tacct file. The following steps outline a simple patch procedure.
How to Fix tacct Errors
Become superuser or assume an equivalent role.
Roles contain authorizations and privileged commands. For more information about roles, see Configuring RBAC (Task Map) in System Administration Guide: Security Services .
Change to the /var/adm/acct/sum directory.
Convert the tacct
MMDD file from binary format to ASCII format.
#/usr/lib/acct/acctmerg -v < tacctMMDD> xtacct
MMDD is pair of two-digit numbers that represent
the month and day.
Edit the xtacct file,
removing corrupted records and writing duplicate records to another file.
Convert the xtacct file
from ASCII format to binary format.
#/usr/lib/acct/acctmerg -i < xtacct > tacctMMDD
Merge the files tacctprev and tacct.
MMDD into the tacct file.
#/usr/lib/acct/acctmerg < tacctprev tacctMMDD> tacct
The runacct script can fail for several reasons.
The following are the most common reasons:
A system crash
The /var directory is running out of
space
A corrupted wtmpx file
If the active.MMDD file
exists, check it first for error messages. If the active and lock files exist, check the fd2log file for
any relevant messages.
Run without arguments, the runacct script assumes
that this invocation is the first invocation of the day. The argument MMDD is necessary if the runacct script is
being restarted and specifies the month and day for which the runacct script
reruns the accounting. The entry point for processing is based on the contents
of the statefile file. To override the statefile file,
include the desired state on the command line. For a description of the available
states, see the
runacct
(
1M
)
man
page.
When you run the runacct program manually,
be sure to run it as user adm.
How to Restart the runacct Script
Change directories to the /var/adm/acct/nite directory.
$ cd /var/adm/acct/nite
Remove the lastdate file
and any lock* files, if any.
$ rm lastdate lock*
The lastdate file contains the date that the runacct program was last run. Restarting the runacct script
in the next step re-creates this file.
Restart the runacct script.
$/usr/lib/acct/runacctMMDD[state]2> /var/adm/acct/nite/fd2log &