In general, it would be the UNIX system administrator’s job to set up Process Accounting, manage the pacct files and protect the system against stalling through lack of disk space in a vital filesystem such as /var.
- Create an empty pacct file, usually in /var/adm/pacct or /var/account/pacct.
- Start Process Accounting by running /usr/sbin/acct/accton /var/adm/pacct
- Check the pacct file is growing by issuing ls -l /var/adm/pacct two or three times.
- Consider adding a system crontab entry to manage the pacct file using the ckpacct utility provided with most UNIX systems. This checks if the size of the pacct file is larger than a user-provided parameter, and if it is, momentarily stops Process Accounting, renames pacct to pacct.<n> where <n> is an ascending number, creates a new pacct file and then re-enables Process Accounting. Management of the pacct.<n> files can also be controlled through a crontab entry, perhaps zipping files over 3 days old and deleting zipped files over one week old.
- Enter the appropriate command(s) into the system start-up scripts to ensure Process Accounting is started up after a reboot (usually the /etc/rc scripts)
For all of the above, you or your UNIX system administrator should consult the operating system documentation, and follow any established procedures for your organization.
Some customers choose to relocate the pacct file to a file system other than /var to further protect the system from having disk space filled up by Process Accounting. While this provides an extra level of security against stalling a system, you must be careful to ensure that the management of pacct file is not affected by this. Many UNIX systems have ckpacct and turnacct commands that have hard coded references to the location of the pacct file, and you may have to take a local of copy of these, edit them for your environment and use these local copies to manage your data.
If you choose to relocate the pacct file to a non-standard location, ensure you set up the Metron.save.d directory as performed by the Acquire installation script. This directory is vital to allow Acquire to reference the previous pacct file if has been renamed to pacct.<n> since the Acquire last ran.