On 2015-07-31 Fri 09:06 AM |, Craig Skinner wrote: > Hello, > > The diffs below produce this output: > > daily(8) email segment (if verbose): > > System accounting records: > COMMANDS TIME I/O CORE USER > 6407 22.02 70521 0 root > 142 0.10 383 0 operator > 440 1.07 0 0 sshd > 1398 113.39 267245 0 _spamd > 484 0.55 784 0 _postfix > 4 0.00 2 0 _squid > 76 0.10 118 0 _dovecot > 8 0.01 21 0 _dovenull > 36 0.01 333 0 _mlmmj > 3198 4.57 9798 0 xxxxxxxxxxxxxxx > 138 0.03 230 0 cvs > 41 0.01 20 0 webmaster > 76 0.27 581 0 postmaster > 103 0.12 1152 0 sysadmin > 153 0.04 224 0 hostmaster > 53 0.01 91 0 xxxxxxxxxxxxx > 4 0.01 4 0 xxxxxxxxxxx > > > USER is left justified in right column due to > passwd(5) names being upto 31 characters long. > > > $ ls -lh /var/account > total 844 > -rw-r--r-- 1 root wheel 68.9K Jul 31 08:54 acct > -rw-r--r-- 1 root wheel 0B Jul 31 02:00 acct.bak > -rw-r--r-- 1 root wheel 56.0K Jul 31 01:30 acct.bak.0.gz > -rw-r--r-- 1 root wheel 44.7K Jul 30 01:30 acct.bak.1.gz > -rw-r--r-- 1 root wheel 37.8K Jul 29 01:30 acct.bak.2.gz > -rw-r--r-- 1 root wheel 37.9K Jul 28 01:30 acct.bak.3.gz > -rw-r--r-- 1 root wheel 24.2K Jul 27 01:30 acct.bak.4.gz > -rw-r--r-- 1 root wheel 33.0K Jul 26 01:30 acct.bak.5.gz > -rw-r--r-- 1 root wheel 46.8K Jul 25 01:30 acct.bak.6.gz > -rw-r--r-- 1 root wheel 32.0K Jul 31 01:30 savacct > -rw-r--r-- 1 root wheel 32.0K Jul 31 01:30 usracct > >
Arrrgh! Clash of sa(8) commands. Running 'sa -sq' quietly summarises the accounting file. While 'sa -smi' nukes the summary history files & only summarises what's in the live accounting file. I don't know if sa's '-i' & '-s' flags are intended to work this way when specified together, if they're incompatible, or this is a bug. Separated verbose stats to truncation works OK: (Tested Saturday -> Monday & nobody's weekly locatedb activity is saved) Index: daily =================================================================== RCS file: /cvs/src/etc/daily,v retrieving revision 1.83 diff -u -p -r1.83 daily --- daily 29 Apr 2015 00:10:44 -0000 1.83 +++ daily 3 Aug 2015 10:15:52 -0000 @@ -64,14 +64,23 @@ fi # >/dev/null 2>&1; } #fi -next_part "Purging accounting records:" -if [ -f /var/account/acct ]; then - mv -f /var/account/acct.2 /var/account/acct.3 - mv -f /var/account/acct.1 /var/account/acct.2 - mv -f /var/account/acct.0 /var/account/acct.1 - cp -f /var/account/acct /var/account/acct.0 + +next_part "System accounting records:" +acct='/var/account/acct' +[[ -f ${acct} && -s ${acct} ]] && +{ + [[ ${VERBOSESTATUS} == '0' ]] || + { + printf "%s%8s%9s%7s%7s\n" 'COMMANDS' 'TIME' 'I/O' 'CORE' 'USER' + sa -mi | awk '{ printf "%8d%8.2f%9d%7d %-s\n", $2, $3, $4, $5, $1 }' + } + + # For rotation by newsyslog: + cp -p ${acct} ${acct}.bak + + # Truncate & summarise merge the accounting file sa -sq -fi +} # If ROOTBACKUP is set to 1 in the environment, and # if filesystem named /altroot is type ffs and mounted "xx", Index: newsyslog.conf =================================================================== RCS file: /cvs/src/etc/newsyslog.conf,v retrieving revision 1.33 diff -u -p -r1.33 newsyslog.conf --- newsyslog.conf 27 Aug 2014 13:46:32 -0000 1.33 +++ newsyslog.conf 3 Aug 2015 10:15:52 -0000 @@ -16,3 +16,4 @@ /var/log/pflog 600 3 250 * ZB "pkill -HUP -u root -U root -t - -x pflogd" /var/www/logs/access.log 644 4 * $W0 Z "pkill -USR1 -u root -U root -x httpd" /var/www/logs/error.log 644 7 250 * Z "pkill -USR1 -u root -U root -x httpd" +/var/account/acct.bak 644 7 1 * ZB