extacct(5) extacct(5)
extacct - introduction to IRIX extended accounting features
The accounting done by IRIX has traditionally been process oriented: a
new accounting record is produced for each process that has been run,
containing statistics about the resources used by that individual
process. Although this is fine for sites with average workloads, it can
be too grainy for sites that have large amounts of traffic, with the
result that the accounting files quickly become too large and
unmanageable. Since accounting is typically employed to charge
individual projects or departments for overall resource utilization, it
would often be sufficient to simply summarize the resource usage of an
entire login session or batch job. This could cut down significantly on
the amount of disk space required for accounting data. Therefore, IRIX
provides a feature to perform accounting by array session, in which each
accounting record that is written contains the accumulated statistics for
all of the processes that were part of that array session. This is in
addition to process-level accounting, not in place of it; the two
accounting modes are separately controlled so it is possible to have
either, both, or neither style of accounting enabled.
The data that is collected and reported for array sessions is a superset
of the data that is reported by the traditional process accounting
facility. In particular, the following items are reported for array
sessions but not reported by traditional process accounting:
* Array session handle (see array_sessions(5))
* Service provider information (see array_sessions(5))
* Project ID (see projects(5))
* Number of swaps
* Number of bytes read, number of bytes written (separately)
* Number of read requests, number of write requests
* Time spent waiting for block I/O
* Time spent waiting for raw I/O
* Time spent waiting on the run queue
Some of this information would also be useful for sites that otherwise
make use of process accounting. Therefore, a second type of process
accounting, "extended process accounting", is provided by IRIX. Again,
it is controlled separately from session accounting or traditional
process accounting.
IRIX writes session and extended process accounting data using the System
Audit Trail (SAT) facility. This is different from traditional process
accounting, which typically writes its data to the file /var/adm/pacct.
Audit data is collected directly from the kernel by the satd(1M) program,
then either written directly to files or else passed on to other filters
or postprocessing programs. To include accounting records in the audit
data, it is necessary to enable the audit events sat_proc_acct (for
extended process accounting records) and/or sat_session_acct (for session
accounting records). This can be done using the satconfig(1M) or
Page 1
extacct(5) extacct(5)
sat_select(1M) commands. If the audit facility is not being used for any
purpose other than accounting, no other events need to be enabled. For
more information on configuring the audit facility, see the IRIX Admin:
Backup, Security, and Accounting guide.
Session accounting records can be written in two formats, differing only
in the treatment of service provider information. In IRIX 6.4 and
earlier, the service provider information for an array session was always
exactly 64 bytes in length, while starting with IRIX 6.5 it could
potentially vary from 0 to 1024 bytes in length. In "session accounting
format 1" (the system default, and the format supported in IRIX 6.4 and
earlier), exactly 64 bytes of service provider information will be
reported for each array session. If in fact the array session has fewer
than 64 bytes of service provider information associated with it, then it
will be padded at the end with zeroes. Likewise, if it has more than 64
bytes of service provider information, the 65th and subsequent bytes will
be truncated. In "session accounting format 2", the exact number of
bytes of service provider information associated with the array session
will be reported, along with a field specifying this length. In this
case, it is possible for session accounting records to have varying
lengths, but there will be no loss of data. The session accounting
format can be changed dynamically by the superuser using the arsctl(2)
system call or the xactl(1M) program. It can also be set for boot time
be changing the kernel variable sessaf using the systune(1M) program.
Note that the utility programs for traditional SVR4 process accounting
(for example, acctcms, acctmerg, and turnacct) do not function with the
extended process accounting or session accounting data. It is possible
to convert extended accounting data into the SVR4 format (see the
acctcvt(1) program for details), but the metrics that are unique to
extended accounting will be lost. Software to process unmodified
extended accounting data is available from independent software vendors.
The format of the audit data files themselves are described in the system
header files sys/sat.h and sys/extacct.h.
Like any accounting or monitoring package, the extended process
accounting and session accounting features do contribute to overall
system overhead. For this reason, they are disabled in the kernel by
default. To enable these features, use the systune(1M) program to modify
either or both of these variables:
do_sessacct Enables session accounting if non-zero
do_extpacct Enables extended process accounting if non-zero
The following steps are required to set up session or extended process
accounting:
* Enable session and/or extended process accounting in the kernel by
using the systune(1M) utility to set the do_sessacct and/or
do_extpacct parameters to non-zero values.
Page 2
extacct(5) extacct(5)
* Use the inst(1M) utility to install the eoe.sw.audit subsystem from
your IRIX distribution media. This will add the special components
required for the system audit trail facility to your system. It will
be necessary to reboot the system after completing this step.
* Enable the audit facility in general by using the chkconfig(1M)
utility as follows:
chkconfig audit on
* Use the satconfig program to enable the sat_proc_acct and/or
sat_session_acct audit events. If the audit facility is being used
only for accounting purposes, all other events can be turned off to
conserve disk space.
The format of the data stream generated by the System Audit Trail
facility changed between IRIX 6.2 and IRIX 6.4, then again between IRIX
6.4 and IRIX 6.5. Therefore, software that was designed to read
accounting data from one of those earlier IRIX releases may not work with
more recent IRIX releases (and vice versa). To help address this
situation, the acctcvt(1) program can be used to convert data files or
even the audit data stream (when used as a filter) from one format to
another.
acctcvt(1), audit(1M), sat_select(1M), satconfig(1M), satd(1M),
systune(1M), xactl(1M), arsctl(2), arsop(2), array_sessions(5),
audit_filters(5), projects(5).
IRIX Admin: Backup, Security, and Accounting
PPPPaaaaggggeeee 3333 [ Back ]
|
