Date: Sun, 12 Nov 2000 16:13:50 -0600 From: Tim Tsai <tim@futuresouth.com> To: cjclark@alum.mit.edu Cc: freebsd-stable@FreeBSD.ORG Subject: Re: periodic and 310.accounting Message-ID: <20001112161350.A8992@futuresouth.com> In-Reply-To: <20001112134724.O75251@149.211.6.64.reflexcom.com>; from cjclark@reflexnet.net on Sun, Nov 12, 2000 at 01:47:24PM -0800 References: <20001112075532.A7158@futuresouth.com> <20001112134724.O75251@149.211.6.64.reflexcom.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, Nov 12, 2000 at 01:47:24PM -0800, Crist J . Clark wrote:
> I wanted to point out that the "logs" are kept for much longer than
> three days. The raw accounting files are only kept for three days, but
> I believe that /var/account/savacct and /var/account/usracct are never
> touched by any of the distributed daily/weekly/monthly scripts. Your
> accounting information will be saved forever unless you remove it.
savacct and usracct are just summary files though, right? I was looking
for the login times of a particular user and I believe I need the raw log
files for that.
> > and
> > the much smarter way is the method used by /etc/newsyslog.conf. Actually,
> > I'd prefer to use newsyslog.conf to handle the accounting files as well.
>
> That is an interesting idea. The problem with that method is that you
> probably want to run a 'sa -s' command right when the logs are rotated
> in the same way newsyslog HUPs syslogd right after it does the
> rotations.
True. It'll work for me though since I don't care much for the summary
information anyway. Also I meant to say that I'd prefer to use newsyslog
to handle the log files. I don't actually want to lump them into
/etc/newsyslog.conf. My script to run newsyslog could very well run sa
-s at the same time.
It looks to me there is a small race condition with the 310.accounting
script.
cp -pf acct acct.0 || rc=3
sa -s >/dev/null || rc=3
wouldn't commands logged between the two statements be lost? I can't
think of a way to work around this though. Or is there some special
system magic that I am missing?
> What version are you running? Have you seen the new
> /usr/local/etc/periodic/ insanity yet? Have a look at
> /etc/defaults/periodic.conf and the periodic script,
> /usr/sbin/periodic, to see how it all works.
Thanks for the info. I did not realize this was only introduced recently
and thanks to another pointer found it after updating to the latest
-stable.
Tim
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-stable" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20001112161350.A8992>