** Description changed: Binary package hint: linux-image-2.6.12-10-686-smp With linux-image-2.6.12-9-686-smp, the utilities provided with the acct package worked fine. With the latter kernel, 'lastcomm' cannot parse the structure anymore: $ lastcomm | tail ?? S root ?? 0.16 secs Wed Dec 31 16:00 ?? S root ?? 0.16 secs Wed Dec 31 16:15 8? root ?? 0.16 secs Wed Dec 31 16:15 ?? S root ?? 0.16 secs Wed Dec 31 16:00 ?? S root ?? 0.16 secs Wed Dec 31 16:15 ?? root ?? 0.16 secs Wed Dec 31 16:15 ?? F root ?? 0.00 secs Wed Dec 31 16:00 ?? S root ?? 0.00 secs Wed Dec 31 16:00 ?? root ?? 0.00 secs Wed Dec 31 16:00 x? S root ?? 0.00 secs Wed Dec 31 16:00 $ date Fri Jun 16 15:18:05 PDT 2006 $ dpkg -l acct | grep acct ii acct 6.3.5-39 The GNU Accounting utilities for process and login accounting I tried stopping accounting, putting an empty pacct file in place, and restarting it, but the kernel still writes out incongruent data. Since the acct package hasn't changed, the kernel must now be writing out a modified structure. + + This is also a security problem since we no longer have an accurate + record of which process ran when.
-- kernel is unmatched with userspace accounting tools https://launchpad.net/bugs/50052 -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
