Hello Ellen I just remember that i rewrote partially this script on the next release due to this bug :-)
This was due to the old logrotate configuration for wtmp rotation that was done once a month just before the execution of this script. So wtmp.1 (or wtmp.1.gz) was always present. This is no longer the case and i updated this script to reflect this new situation. This bug was already fixed in the current testing release (6.6.4-4). This is current acct.cron.monthly: https://salsa.debian.org/pkg-security-team/acct/-/raw/debian/master/debian/acct.cron.monthly Greetings, Marcos. l mié, 13-01-2021 a las 15:16 -0800, Ellen Wang escribió: > Here we go: > > # ls -l /var/log/wtmp* > -rw-rw-r-- 1 root utmp 198144 Jan 6 09:24 /var/log/wtmp > -rw-r----- 1 root adm 88 Jan 13 15:05 /var/log/wtmp.report > > # sh -x /etc/cron.monthly/acct > + LOGROTATE=/etc/cron.daily/logrotate > + test -x /usr/sbin/accton > + date > + echo Login accounting for the month ended Wed Jan 13 15:07:43 PST > 2021: > + echo > + [ -f /etc/cron.daily/logrotate ] > + [ -x /usr/sbin/logrotate ] > + [ -f /var/log/wtmp.1 ] > + [ -f /var/log/wtmp.1.gz ] > + ac -f -p > + sort -nr -k2 > couldn't open file '': No such file or directory > + echo > + last -f > last: cannot open : No such file or directory > + [ -n ] > + chown root:adm /var/log/wtmp.report > + chmod 640 /var/log/wtmp.report > > -- > > What does your script look like? I ran the one installed in > /etc/cron.monthly (with 10.7 buster). Your output looks like there > are > some differences besides not failing. > > > On 1/13/21 2:16 PM, Marcos Fouces wrote: > > Hello Ellen > > > > I renamed temporarily wtmp.1 and i run the script with "set-x" to > > see > > what is going on: > > > > # ./$HOME/Debian/Packages/acct/debian/acct.cron.monthly > > + test -x /usr/sbin/accton > > + echo > > ################################################################### > > # > > + echo ################# LOGIN ACCOUNTING MONTHLY REPORT > > ################## > > + echo > > ################################################################### > > # > > + echo > > + date > > + echo Login accounting for the month ended mié 13 ene 2021 > > 23:09:40 > > CET: > > + echo > > + test -f /var/log/wtmp.1 > > + test -f /var/log/wtmp.1.gz > > + echo Data contained in current wtmp file: > > + ac -p > > + sort -nr -k2 > > + echo > > + last > > + chown root:adm /var/log/wtmp.report > > + chmod 640 /var/log/wtmp.report > > > > > > Could you check this on your machine, please. > > > > Thanks for your bug report. > > > > Greetings, > > Marcos. > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Thanks for your bug report. > > > > > > El dom, 01-11-2020 a las 11:03 -0800, Ellen Wang escribió: > > > Package: acct > > > Version: 6.6.4-2 > > > > > > On a newly installed system, /etc/cron.monthly/acct complains: > > > > > > /etc/cron.monthly/acct: > > > couldn't open file '': No such file or directory > > > last: cannot open : No such file or directory > > > > > > The problem is that the script wants to use /var/log/wtmp.1 > > > instead > > > of > > > wtmp if logrotate exists, on the assumption that logrotate has > > > already > > > moved wtmp to wtmp.1. However, this is not true if wtmp is not > > > big > > > enough to have been rotated. > > > > > > This patch gets rid of the error: > > > > > > --- /etc/cron.monthly/acct# 2018-08-23 09:01:38.000000000 - > > > 0700 > > > +++ /etc/cron.monthly/acct 2020-11-01 10:13:58.310091356 - > > > 0800 > > > @@ -33,7 +33,10 @@ > > > > > > gunzip -c /var/log/wtmp.1.gz > > > > "${WTMP}" > > > fi > > > + fi > > > > > > + if [ -n "${WTMP}" ] > > > + then > > > ac -f "${WTMP}" -p | sort -nr -k2 >> > > > /var/log/wtmp.report > > > echo >> /var/log/wtmp.report > > > last -f "${WTMP}" >> /var/log/wtmp.report > > > > > > Perhaps a better fix would be to fall back to wtmp.1 only if wtmp > > > is > > > empty. Alternatively, if we want a monthly report that covers > > > exactly > > > one month, then not specifying minsize in /etc/logrotate.d/wtmp > > > is > > > the > > > solution. > > > > >
