On Sun, Nov 13, 2005 at 12:20:31AM -0500, Hugo Villeneuve wrote:
>
> wtmp is rotated every 7 days by newsyslog. It's the same frequency
> has /etc/weekly but they are totally unrelated events.
>
oops. thanks for pointing this out.
> If someone wants to use "ac" in /etc/{weekly,monthly}, he _has_ to
> change the wtmp entry in newsyslog.conf.
>
> The not proper method but the easyest is to make the log rotate an
> hour after the scripts are run. That way you know you have almost
> the right amount of data for "ac" at the time the script is running.
>
> For weekly something like: $W6D4
> For monthly: $M1D6
>
> (I did not test. If "ac" is to be run before updatedb in weekly,
> it is easier to guess when it will be run than after updatedb.)
>
this will work well enough, and i eventually settled on the $W6D4 fix.
see below also..
> The proper method would be to run "ac" at the same time wtmp is
> rotated. (Either weekly/monthly rotates the file or newsyslog runs
> a command to mail an "ac" report.)
>
this is not so simple. if newsyslog(8) executes ac(8), it will run *after*
truncation, giving a 0.00 accounting time.
if however we ask weekly(8) to truncate wtmp after ac(8) runs, there is
also an issue:
newsyslog -F /var/log/wtmp
would work, but relies on there being an entry for wtmp in
/etc/newsyslog. and if there is, it will be rotated at some other time
anyway.
so i think your first suggestion works best.
thanks again
jmc
