From: azog@spatula.rent.com (Billy D'Augustine)
Newsgroups: comp.os.vms
Subject: VMS accounting questions
Date: 8 Oct 92 23:02:12 GMT


Hiyas. I have some questions regarding VMS accounting and am hoping
that someone can help me. Please reply via email at the address below,
and Ill post a summary if enough people request it. Please note also 
that I am posting this via UCBs server.

Ive started VMS accounting with the following commands:

$ set acc/ena=(image,process,...) 

(the ... are for the rest of the accounting types. I am concerned with
image accounting here, as thats where my problem lies, and where I get
most of my useful accounting info)

The problem is that just image accounting seems to get disabled. Ive
never been able to discern a pattern. Its seems to be weeks at a time
that it happens. Ill start it up, and do a $ sh acc each day, and just
out of the blue, one day, image accounting will be disabled.

This is VMS 5.4 on a 6420. Can anyone tell me why it does this? I like
to extract accounting for the previous day with the /before=today and
/after=yesterday qualifiers and print it out. Some days, Ill forget to
check to make sure that image accounting is still enabled, and then Ill
miss a lot of data. Of course, this makes it hard to track unauthorized
access by users, and helps me track down trouble from when people say theyve
run something and it doesnt work (I can check and see if indeed theyve
run it or not). We are a local government facility serving our library
network, so we dont use accounting for charges...

Now, another problem... Because of the above behaviour, in our nightly
processing, I inserted a batch job into the daily stream, basiclly its
the same account enable command. This way, if image accounting is disabled,
itll start before users gain access to the system the next morning. 

However, using that technique, Ive started getting strange errors. Below
is the logfile for a batch job that I would like to run after midnight
each night to extract the data...

$ if (f$mode() .eqs. "BATCH") then goto batch
$ batch:
$ write sys$output f$time()
 7-OCT-1992 16:16:58.74
$ exit
if f$mode() .eqs. "BATCH" then exit
$ acc/since=yesterday/before=today -
  /summary=(user,image,date,hour) -
  /out=sys$sysdevice:[bill]acc.dat -
  /report=(elapsed,processor,record)/type=image
%ACC-E-READERR, error reading SYS$SYSROOT:[SYSMGR]ACCOUNTNG.DAT;1
-ACC-W-INVTIME, record 5680 has time in the future
  BILL         job terminated at  7-OCT-1992 16:18:33.38

  Accounting information:
  Buffered I/O count:              65         Peak working set size:    1139
  Direct I/O count:               528         Peak page file size:      3782
  Page faults:                   1003         Mounted volumes:             0


The problem is that it tells me that at least one record is dated in
the future! How can this be? It stops processing on that record, so 
I cant look and see what it is. And I dont really feel like doing an
$ acc/full interactivly for over 5000 accounting records.

This has only started occuring when I tried to restart image accounting
regardless if its already running or not. 

(at one point in time I had the output going to a file with the date
of accounting as the name, such as 7-OCT-1992.ACC, so if I forget to
print it, theres no way for me to accidently delete it...)

Many thanx. 

Billy D'Augustine
azog@spatula.rent.com