Fixing Corrupted Files and wtmpx Errors

Unfortunately, system accounting is not foolproof. Occasionally, a file becomes corrupted or lost. Some of the files can simply be ignored or restored from backup. However, certain files must be fixed to maintain the integrity of system accounting.

The wtmpx files seem to cause the most problems in the daily operation of the system accounting. When the date is changed manually and the system is in multiuser mode, a set of date change records is written into the /var/adm/wtmpx file. The wtmpfix utility is designed to adjust the time stamps in the wtmp records when a date change is encountered. However, some combinations of date changes and reboots slip through the wtmpfix utility and cause the acctcon program to fail.

How to Fix a Corrupted wtmpx File

1. Become superuser.

2. Change to the /var/adm directory.

3. Convert the wtmpx file from binary to ASCII format.

   # /usr/lib/acct/fwtmp < wtmpx > wtmpx.ascii

4. Edit wtmpx.ascii to delete the corrupted records.

5. Convert the wtmpx.ascii file back to a binary file.

   # /usr/lib/acct/fwtmp -ic < wtmpx.ascii > wtmpx

   See fwtmp(1M) for more information.

Fixing tacct Errors

The integrity of the /var/adm/acct/sum/tacct file is important if you are charging users for system resources. Occasionally, unusual tacct records appear with negative numbers, duplicate user IDs, or a user ID of 65535. First, check the /var/adm/acct/sum/tacctprev file by using the prtacct script to print it. If the contents look all right, patch the latest /var/adm/acct/sum/tacctMMDD file, then recreate the /var/adm/acct/sum/tacct file. The following steps outline a simple patch procedure.

How to Fix tacct Errors

1. Become superuser.

2. Change to the /var/adm/acct/sum directory.

3. Convert the tacctMMDD file from binary to ASCII format.

   # /usr/lib/acct/acctmerg -v < tacctMMDD > xtacct

   MMDD is pair of two-digit numbers that represent the month and day.

4. Edit the xtacct file, removing corrupted records and writing duplicate records to another file.

5. Convert the xtacct file from ASCII format to binary.

   # /usr/lib/acct/acctmerg -i < xtacct > tacctMMDD

   MMDD is pair of two-digit numbers that represent the month and day.

6. Merge the files tacctprev and tacct.MMDD into the tacct file.

   # /usr/lib/acct/acctmerg < tacctprev tacctMMDD > tacct

Restarting the runacct Script

The runacct script can fail for a variety of reasons. The most common reasons are a system crash, the /var directory running out of space, or a corrupted wtmpx file. If the active.MMDD file exists, check it first for error messages. If the active and lock files exist, check fd2log for any relevant messages.

Run without arguments, the runacct script assumes that this invocation is the first invocation of the day. The argument MMDD is necessary if the runacct script is being restarted and specifies the month and day for which the runacct script reruns the accounting. The entry point for processing is based on the contents of the statefile file. To override the statefile file, include the desired state on the command line. For a description of the available states, see runacct(1M).

---

Caution - When you run the runacct program manually, be sure to run it as user adm.

---

How to Restart the runacct Script

1. Remove the lastdate file and any lock* files, if any.

   $ cd /var/adm/acct/nite $ rm lastdate lock*

   The lastdate file contains the date that the runacct program was last run. Restarting runacct in the next step recreates this file.

2. Restart the runacct script.

   $ /usr/lib/acct/runacct MMDD [state] 2> /var/adm/acct/nite/fd2log &

   MMDD	Month and day specified by two-digit numbers.
   state	Specifies a state, or starting point, where the runacct processing should begin.

Stopping and Disabling System Accounting

You can temporarily stop system accounting or disable it permanently.

How to Temporarily Stop System Accounting

1. Become superuser.

2. Edit the adm crontab file to stop the ckpacct, runacct, and monacct programs from running by commenting out the appropriate lines.

   # EDITOR=vi; export EDITOR # crontab -e adm #0 * * * * /usr/lib/acct/ckpacct #30 2 * * * /usr/lib/acct/runacct 2> /var/adm/acct/nite/fd2log #30 7 1 * * /usr/lib/acct/monacct

3. Edit the crontab file for user root to stop the dodisk program from running by commenting out the appropriate line.

   # crontab -e #30 22 * * 4 /usr/lib/acct/dodisk

4. Stop the accounting program.

   # /etc/init.d/acct stop

5. (Optional) Remove the newly added comment symbols from the crontab files and restart the accounting program to re-enable system accounting.

   # /etc/init.d/acct start

How to Permanently Disable System Accounting

1. Become superuser.

2. Edit the adm crontab file and delete the entries for the ckpacct, runacct, and monacct programs.

   # EDITOR=vi; export EDITOR # crontab -e adm

3. Edit the root crontab file and delete the entries for the dodisk program.

   # crontab -e

4. Remove the startup script for Run Level 2.

   # unlink /etc/rc2.d/S22acct

5. Remove the stop script for Run Level 0.

   # unlink /etc/rc0.d/K22acct

6. Stop the accounting program.

   # /etc/init.d/acct stop