Installation guide

12.4 Connect Session Accounting
When a user logs in or logs out, the login and init commands write the
user login and logout history to records in the /var/adm/wtmp binary
database file. The /var/adm/utmp binary database file is the active
connect session file. All hangups, terminations of the login command, and
terminations of the login shell cause the system to write logout records, so
the number of logouts is often more than the number of sessions.
Connect session commands can convert the /var/adm/wtmp file records to
useful connect session accounting records. You can obtain connect session
accounting only if the /var/adm/wtmp file exists.
The formatted records in the /var/adm/wtmp file provide the following
information about each connect session:
• User login name (from the /etc/passwd file)
• Line identification number (from the /etc/inittab file)
• The device name (for example, console or tty23 )
• Type of entry
• Process identification number
• Process termination status
• Process exit status
• Time entry was made
• Host machine name
You can use the following two shell scripts and seven commands to obtain
or modify information about system connect sessions:
Command Description
ac
This command displays connect session records for the entire
system and for each user.
acctcon1
This command summarizes connect session records and displays
those records in ASCII format, using one line for each connect
session.
acctcon2
This command uses the output of the acctcon1 command to
produce an accounting record file of the total connect session in
ASCII format.
acctwtmp
This command enables you to write records to the wtmp file by
entering them from the keyboard.
fwtmp
This command displays records from files with the utmp.h file
structure.
Administering the System Accounting Services 12–13