[See below for a comment regarding #51796 ("wtmp is rotated before the report (logrotate?)").]
[Quotes "regenerated" from original mails to provide context.] > > * Fabian Pietsch <[EMAIL PROTECTED]> (Wed, 24 Aug 2005 21:08:45 +0200): > > > In /etc/cron.monthly/acct, a monthly report of system and user activity > > > logged in the wtmp file is generated; part of this is the following: > > > > > > if [ -f $LOGROTATE ] && [ -x /usr/sbin/logrotate ] > > > then > > > [...] > > > ac -f $WTMP /var/log/wtmp.1 -p | sort -nr +1 >> > > > /var/log/wtmp.report > > > [...] > > > else > > > ac -p | sort -nr +1 >> /var/log/wtmp.report > > > [...] > > > fi > > > > > > In the second case, the invocation of ac would summarize connect/login > > > times for all users; in the first, it would do likewise for the user > > > /var/log/wtmp.1 which doesn't exist, so the only ac output will be: > > > > > > total 0.00 > > > > > > The additional parameter to ac seems to have been left when $WTMP was > > > introduced, probably in a fix in acct-6.3.5-38.2, and should most > > > probably be removed to restore functionality. > > * Sam Morris <[EMAIL PROTECTED]> (Tue, 12 Sep 2006 10:20:06 +0100): > > I think that the additional processing of wtmp.1 must be left in to take > > account of log rotation (see #51796). I found that putting an additional > > '-f' parameter before '/var/log/wtmp.1' caused ac to process both files. [Unfortunately I didn't get the above follow-up to my bug report as I was only the reporter, not subscribed to the bug nor manually kept in the loop...] * Debian Bug Tracking System <[EMAIL PROTECTED]> (Sat, 04 Nov 2006 05:03:39 -0800): > Subject: Bug#324910 closed by Daniel Baumann <[EMAIL PROTECTED]> > (Bug#324910: fixed in acct 6.4~pre1-1) > > This is an automatic notification regarding your Bug report > #324910: /etc/cron.monthly/acct typo results in no meaningful ac output in > /var/log/wtmp.report if logrotate is installed, > which was filed against the acct package. > > It has been closed by Daniel Baumann <[EMAIL PROTECTED]>. > [...] > > Changes: > acct (6.4~pre1-1) unstable; urgency=medium > . [...] > * Updated ac call in cron.monthly to process both $WTMP and /var/log/wtmp.1 > (Closes: #324910). I believe $WTMP already contains "/var/log/wtmp.1" if it exists, and the name of an uncompressed temporary copy of a wtmp.1.gz if that exists instead. See below for the full quote of what had been shortened above. Taken from acct-6.4~pre1-1's debian/cron.monthly: | if [ -f "${LOGROTATE}" ] && [ -x /usr/sbin/logrotate ] | then | if [ -f /var/log/wtmp.1 ] | then | WTMP="/var/log/wtmp.1" | elif [ -f /var/log/wtmp.1.gz ] | then | WTMP_WAS_GZIPPED="1" | WTMP="`tempfile`" | | gunzip -c /var/log/wtmp.1.gz > "${WTMP}" | fi | | ac -f "${WTMP}" -f /var/log/wtmp.1 -p | sort -nr -k2 >> /var/log/wtmp.report | echo >> /var/log/wtmp.report | last -f "${WTMP}" >> /var/log/wtmp.report | | if [ -n "${WTMP_WAS_GZIPPED}" ] | then | # remove temporary file | rm -f "${WTMP}" | fi | else | ac -p | sort -nr -k2 >> /var/log/wtmp.report | echo >> /var/log/wtmp.report | last >> /var/log/wtmp.report | fi Therefore it seems to me that as of acct-6.4~pre1-1, /var/log/wtmp.1 will be processed twice in some cases. I still suggest the correct fix for the first occurrence of ac in the above snippet would be: ] ac -f "${WTMP}" -p | sort -nr -k2 >> /var/log/wtmp.report As for #51796, it might well be possible that the empty report is caused by the same superflous explicit occurrence of "/var/log/wtmp.1" (parsed as username by ac), as in my original report -- and therefore not caused by log rotation order, as suggested by #51796's bug title ("wtmp is rotated before the report (logrotate?)"). Or perhaps the whole point of the $WTMP indirection in this script was to fix #51796, but didn't really fix it because of the leftover explicit /var/log/wtmp.1 ;) Regards, Fabian -- Fabian "zzz" Pietsch - http://zzz.arara.de/ -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]