Accounting records

Edit online

There are multiple types of records produced by Advanced Accounting.

Accounting records produced by Advanced Accounting are defined in the sys/aacct.h file. The following table describes these records.

Table 1. Accounting records
Accounting record Description
Pad record (type 0) This record does not provide any meaningful accounting data. Report and analysis tools should skip this record. It is generated for alignment purposes only.
Process record (type 1) This record is written when a process exits, when a process is reclassified (setUser ID(), chproj(), exec()) and when the system is reclassified. This record is written by the process interval.

This record contains the following information:

  • User ID
  • Group ID
  • Process ID
  • Process flags (exited, core, killed by signal, killed by checkpoint)
  • Base command name
  • WLM class
  • Controlling terminal
  • Process start time (in seconds from the EPOCH)
  • Process elapsed time in micro seconds
  • Combined thread elapsed time in micro seconds
  • Process (combined threads) processor time in micro- seconds
  • Elapsed page seconds of disk pages
  • Elapsed page seconds of real pages
  • Elapsed page seconds of virtual memory
  • Local logical file I/O (JFS, J2) in bytes
  • Other logical file I/O (NFS, DFS) in bytes
  • Local socket I/O (UNIX domain and loopback) in bytes
  • Remote socket I/O in bytes

The process start time and Process ID can be used to correlate interval records for a particular process. The exit flag can be used to distinguish between interval and exit records.
Aggregated process record (type 2) This record is derived from the process record. A different record is produced for each user by project.
This record is produced by the process interval and contains the following information:
  • User ID
  • Time of first record aggregated (in seconds from the EPOCH)
  • Number of processes aggregated
  • Aggregate process elapsed time in micro seconds
  • Aggregate thread elapsed time in micro seconds
  • Aggregate process (combined threads) processor time in micro seconds
  • Aggregate elapsed page seconds of disk pages
  • Aggregate elapsed page seconds of real pages
  • Aggregate elapsed page seconds of virtual memory
  • Aggregate local logical file I/O (JFS, J2) in bytes
  • Aggregate other logical file I/O (NFS, DFS) in bytes
  • Aggregate local socket I/O (UNIX domain and loopback) in bytes
  • Aggregate remote socket I/O in bytes
Aggregated application record (type 3) This record is derived from the process record. Records are produced at the user, project, and application level. This record is similar to the aggregated process record, except that the application is named. This record is produced when the process is classified with an application specific rule, which is supported only through the Admin policy.
This record is produced by the process interval and contains the following information:
  • User ID
  • Time of first record aggregated (in seconds from the EPOCH)
  • Inode of the command that generated the project classification
  • Device number of the command that generated the project classification
  • Number of applications aggregated
  • Aggregate process elapsed time in micro seconds
  • Aggregate thread elapsed time in micro seconds
  • Aggregate process (combined threads) processor time in micro seconds
  • Aggregate elapsed page seconds of disk pages
  • Aggregate elapsed page seconds of real pages
  • Aggregate elapsed page seconds of virtual memory
  • Aggregate local logical file I/O (JFS, J2) in bytes
  • Aggregate other logical file I/O (NFS, DFS) in bytes
  • Aggregate local socket I/O (UNIX domain and loopback) in bytes
  • Aggregate remote socket I/O in bytes
Processor and memory use record (type 4) This record provides information about the use of processors and when the size of the large page pool changes. This record is also generated during pre-migration and post-migration and by the system interval.
This record contains the following information:
  • Reason the record was generated
  • Number of online logical processors
  • Entitled physical processor capacity of the partition
  • Total idle time, in milliseconds
  • Total I/O wait time, in milliseconds
  • Total kernel process time, in milliseconds
  • Total user process time, in milliseconds
  • Total interrupt time, in milliseconds
  • Size of physical memory, in megabytes
  • Size of the large page pool, in megabytes
  • Large pages in use, in megabytes
  • Number of page ins from paging space
  • Number of page outs to paging space
  • Number of start I/Os
  • Number of page steals
  • Elapsed time since start of interval, in milliseconds
  • Amount of physical memory allocated to a partition in page-seconds
  • Amount of entitled memory allocated to a partition, reported in 4K pages
  • Amount of I/O memory entitlement in use by a partition in page-seconds
Policy record (type 5) This record is written when a policy file is loaded or unloaded. It is provided for informational purposes only.
This record contains the following information:
  • Type of policy: Admin, User, or Group
  • Load or unload
File system activity record (type 6) This record describes the use of file systems at the system level. A separate record is generated for each mounted file system.
This record is produced by the system interval and has the following information:
  • Total bytes transferred through read and write
  • Total number of read and write requests
  • Total number opens
  • Total number of creates
  • Total number of locks
  • File system type
  • Device name
  • Mount point
Network interface I/O record (type 7) This record provides information about the use of network interfaces at the system level.
This record is produced by the system interval and contains the following information:
  • Logical name of the network interface
  • Number of I/Os
  • Total bytes transferred
Disk I/O record (type 8) This record provides information about the use of disks at the system level. A separate record is written for each logical disk device.
This record is produced by the system interval and contains the following information:
  • Logical name of the disk
  • Total disk transfers
  • Total reads
  • Total writes
  • Block size of the disk transfer
Lost data record (type 9) This record provides information about accounting records that were deleted because Advanced Accounting did not have the ability to record them. This occurs when all of the accounting data files are full. When the ability to write new accounting records is restored, Advanced Accounting produces the lost data record describing the outage.
This record contains the following information:
  • Number of lost records
  • Number of microseconds of lost processor time associated with process records
  • The time that data loss began (in microseconds from EPOCH)
  • Number of microseconds of lost processor time associated with third party kernel extension records
Server VIO record (type 10) This record is produced in hosting partitions. A separate record is produced for each logical device that is shared with a client partition. The system interval can be used to periodically produce this record.
This record contains the following information:
  • Client partition number
  • Server unit ID
  • Device logical unit ID (LUN)
  • Number of bytes in
  • Number of bytes out
Client VIO record (type 11) This record is produced in client partitions. It describes the use of virtual devices in client partitions. A separate record is recorded for each instance of a virtual device. The system interval may be used to periodically produce this record.
This record contains the following information:
  • Server partition number
  • Server unit ID
  • Device logical unit ID
  • Number of bytes in
  • Number of bytes out
Third-party kernel extension common aggregation record (type 12) This record provides accounting information for the named accounting record. It is derived from aggregated accounting records that are produced by third-party kernel extensions. This record is written to Advanced Accounting by the system interval.
This record contains the following information:
  • Command name of the kernel extension (from u-block)
  • Third-party kernel extension transaction ID, in the range of 129 to 256
  • Number of accounting records that have been aggregated
  • Resource use, or accumulated processor time, for this class of transactions
  • Time of first record aggregated (in seconds from the EPOCH)
ARM application environment record (type 13) This record describes an application environment instance. It is created from data that is passed to the operating system through the arm_register_application() system call and the arm_start_application() system call. This record is variable in length. All offsets are calculated relative to the start of the record.
This record contains the following information:
  • Character set in which the data in this record is recorded
  • Application environment identifier
  • Offset to application name
  • Offset to application group
  • Offset to application identity properties
  • Offset to application context properties

The operating system attempts to record the content of the application environment in each accounting data file, so that each accounting data file can be post-processed as a stand-alone item. This is designed to eliminate the dependency between accounting data files.
ARM transaction environment record (type 14) This record describes a transaction environment instance. It is created from data that is passed to the operating system through the arm_register_transaction() system call. This record is variable in length. All offsets are calculated relative to the start of the record.
This record contains the following information:
  • Character set in which the data in this record in recorded
  • Transaction environment identifier
  • Offset to transaction name
  • Offset to application identity properties
  • Offset to application context properties (names only)

The operating system attempts to record the content of the transaction environment in each accounting data file (not guaranteed), so that each accounting data file can be post-processed as a stand-alone item. This is designed to eliminate the dependency between accounting data files.
ARM transaction instance record (type 15) This record describes an ARM transaction instance. It is created from data that is passed to the operating system through the arm_start_transaction() and the arm_stop_transaction() system calls. It is variable in length. All offsets are calculated relative to the start of the record.
This record contains the following information:
  • Completion status of the transaction
  • Application environment identifier
  • Transaction environment identifier
  • Offset to user identifier (not User ID)
  • Offset to user name (not uname)
  • Offset to accounting code
  • Response time, in milliseconds
  • Queued time, in milliseconds
  • Resource use

The application and transaction environment identifiers are defined respectively in the application and transaction environment records. These records must be used to associate application names, application groups, transaction names, and properties with the transaction instance.
ARM aggregated transaction instance record (type 16) This record is produced instead of the ARM transaction instance record (type 15), when aggregation is enabled for ARM transactions.
This record contains the following information:
  • Completion status of the transaction
  • Time of first record aggregated (in seconds from EPOCH)
  • Application environment identifier
  • Transaction environment identifier
  • Offset to user identifier (not user ID)
  • Offset to user name (not uname)
  • Offset to accounting code
  • Aggregate response time, in milliseconds
  • Aggregate queued time, in milliseconds
  • Aggregate resource use
Project definition record (type 17) This record provides a list of project definitions. It is written when the project definition file is loaded. Multiple records may be needed to record all project definitions. This record is used to provide the full set of project information in each data file, so that data files may be treated as stand-alone entities. This may not be required by the billing application, depending on the nature of the billing application. This feature may be disabled by disabling the project definition accounting record.
This record is variable in length and contains the following information:
  • Number of projects
  • Number of bytes in the project definition area
  • Project definition area
WPAR process record (type 33) This record is produced only when WPAR accounting is enabled on Global WPAR. This record is written when a process in an Application WPAR exits, when a process is reclassified (setUser ID(), chproj(), exec()) and when the system is reclassified. This record is written by the process interval.
This record contains the following information:
  • User ID
  • Group ID
  • Process ID
  • Process flags (exited, core, killed by signal, killed by checkpoint)
  • Base command name
  • WLM class
  • Controlling terminal
  • Process start time (in seconds from the EPOCH)
  • Process elapsed time in micro seconds
  • Combined thread elapsed time in micro seconds
  • Process (combined threads) processor time in micro seconds
  • Elapsed page seconds of disk pages
  • Elapsed page seconds of real pages
  • Elapsed page seconds of virtual memory
  • Local logical file I/O (JFS, J2) in bytes
  • Other logical file I/O (NFS, DFS) in bytes
  • Local socket I/O (UNIX domain and loopback) in bytes
  • Remote socket I/O in bytes
  • WPAR Name

The process start time and Process ID can be used to correlate interval records for a particular process. The exit flag can be used to distinguish between interval and exit records.
WPAR aggregated process record (type 34) This record is produced only when WPAR accounting is enabled on Global WPAR. This record is derived from the WPAR process record of an Application WPAR. A different record is produced for each user by project.
This record is produced by the process interval and contains the following information:
  • User ID
  • Time of first record aggregated (in seconds from the EPOCH)
  • Number of processes aggregated
  • Aggregate process elapsed time in micro seconds
  • Aggregate thread elapsed time in micro seconds
  • Aggregate process (combined threads) processor time in micro seconds
  • Aggregate elapsed page seconds of disk pages
  • Aggregate elapsed page seconds of real pages
  • Aggregate elapsed page seconds of virtual memory
  • Aggregate local logical file I/O (JFS, J2) in bytes
  • Aggregate other logical file I/O (NFS, DFS) in bytes
  • Aggregate local socket I/O (UNIX domain and loopback) in bytes
  • Aggregate remote socket I/O in bytes
  • WPAR Name
WPAR aggregated application record (type 35) This record is produced only when WPAR accounting is enabled on Global WPAR. This record is derived from the WPAR process record of an Application WPAR. Records are produced at the user, project, and application level. This record is similar to the aggregated process record, except that the application is named. This record is produced when the process is classified with an application specific rule, which is supported only through the Admin policy.
This record is produced by the process interval and contains the following information:
  • User ID
  • Time of first record aggregated (in seconds from the EPOCH)
  • Inode of the command that generated the project classification
  • Device number of the command that generated the project classification
  • Number of applications aggregated
  • Aggregate process elapsed time in micro seconds
  • Aggregate thread elapsed time in micro seconds
  • Aggregate process (combined threads) processor time in micro seconds
  • Aggregate elapsed page seconds of disk pages
  • Aggregate elapsed page seconds of real pages
  • Aggregate elapsed page seconds of virtual memory
  • Aggregate local logical file I/O (JFS, J2) in bytes
  • Aggregate other logical file I/O (NFS, DFS) in bytes
  • Aggregate local socket I/O (UNIX domain and loopback) in bytes
  • Aggregate remote socket I/O in bytes
  • WPAR Name
WPAR processor and memory use record (type 36) This record is produced only when WPAR accounting is enabled on Global WPAR. This record provides information about the use of processors by System/Application WPAR and when the size of the large page pool changes. This record is also generated during pre-migration and post-migration and by the system interval.
This record contains the following information:
  • Reason the record was generated
  • Number of online logical processors
  • Entitled physical processor capacity of the partition
  • Total idle time, in milliseconds
  • Total I/O wait time, in milliseconds
  • Total kernel process time, in milliseconds
  • Total user process time, in milliseconds
  • Total interrupt time, in milliseconds
  • Size of physical memory, in megabytes
  • Size of the large page pool, in megabytes
  • Large pages in use, in megabytes
  • Number of page ins from paging space
  • Number of page outs to paging space
  • Number of start I/Os
  • Number of page steals
  • Elapsed time since start of interval, in milliseconds
  • WPAR Name
WPAR file system activity record (type 38) This record is produced only when WPAR accounting is enabled on Global WPAR. This record describes the use of file systems specific to a System/Application WPAR at the system level. A separate record is generated for each mounted file system.
This record is produced by the system interval and has the following information:
  • Total bytes transferred through read and write
  • Total number of read and write requests
  • Total number opens
  • Total number of creates
  • Total number of locks
  • File system type
  • Device name
  • Mount point
  • WPAR Name
WPAR network interface I/O record (type 39) This record is produced only when WPAR accounting is enabled on Global WPAR. This record provides information about the use of network interfaces by a system/Application WPAR at the system level.
This record is produced by the system interval and contains the following information:
  • Logical name of the network interface
  • Number of I/Os
  • Total bytes transferred
  • WPAR Name
WPAR third-party kernel extension common aggregation record (type 44) This record is produced only when WPAR accounting is enabled on Global WPAR. This record provides accounting information for the named accounting record. It is derived from aggregated accounting records of an Application WPAR that are produced by third-party kernel extensions. This record is written to Advanced Accounting by the system interval.
This record contains the following information:
  • Command name of the kernel extension (from u-block)
  • Third-party kernel extension transaction ID, in the range of 129 to 256
  • Number of accounting records that have been aggregated
  • Resource use, or accumulated processor time, for this class of transactions
  • Time of first record aggregated (in seconds from the EPOCH)
  • WPAR Name