On 2015-07-31 Fri 09:06 AM |, Craig Skinner wrote:
> Hello,
>
> The diffs below produce this output:
>
> daily(8) email segment (if verbose):
>
> System accounting records:
> COMMANDS TIME I/O CORE USER
> 6407 22.0270521 0 root
> 142 0.10 383 0 operator
> 440 1.070 0 sshd
> 1398 113.39 267245 0 _spamd
> 484 0.55 784 0 _postfix
>4 0.002 0 _squid
> 76 0.10 118 0 _dovecot
>8 0.01 21 0 _dovenull
> 36 0.01 333 0 _mlmmj
> 3198 4.57 9798 0 xxx
> 138 0.03 230 0 cvs
> 41 0.01 20 0 webmaster
> 76 0.27 581 0 postmaster
> 103 0.12 1152 0 sysadmin
> 153 0.04 224 0 hostmaster
> 53 0.01 91 0 x
>4 0.014 0 xxx
>
>
> USER is left justified in right column due to
> passwd(5) names being upto 31 characters long.
>
>
> $ ls -lh /var/account
> total 844
> -rw-r--r-- 1 root wheel 68.9K Jul 31 08:54 acct
> -rw-r--r-- 1 root wheel 0B Jul 31 02:00 acct.bak
> -rw-r--r-- 1 root wheel 56.0K Jul 31 01:30 acct.bak.0.gz
> -rw-r--r-- 1 root wheel 44.7K Jul 30 01:30 acct.bak.1.gz
> -rw-r--r-- 1 root wheel 37.8K Jul 29 01:30 acct.bak.2.gz
> -rw-r--r-- 1 root wheel 37.9K Jul 28 01:30 acct.bak.3.gz
> -rw-r--r-- 1 root wheel 24.2K Jul 27 01:30 acct.bak.4.gz
> -rw-r--r-- 1 root wheel 33.0K Jul 26 01:30 acct.bak.5.gz
> -rw-r--r-- 1 root wheel 46.8K Jul 25 01:30 acct.bak.6.gz
> -rw-r--r-- 1 root wheel 32.0K Jul 31 01:30 savacct
> -rw-r--r-- 1 root wheel 32.0K Jul 31 01:30 usracct
>
>
Arrrgh! Clash of sa(8) commands.
Running 'sa -sq' quietly summarises the accounting file.
While 'sa -smi' nukes the summary history files & only
summarises what's in the live accounting file.
I don't know if sa's '-i' & '-s' flags are intended to work this way
when specified together, if they're incompatible, or this is a bug.
Separated verbose stats to truncation works OK:
(Tested Saturday -> Monday & nobody's weekly locatedb activity is saved)
Index: daily
===
RCS file: /cvs/src/etc/daily,v
retrieving revision 1.83
diff -u -p -r1.83 daily
--- daily 29 Apr 2015 00:10:44 - 1.83
+++ daily 3 Aug 2015 10:15:52 -
@@ -64,14 +64,23 @@ fi
# >/dev/null 2>&1; }
#fi
-next_part "Purging accounting records:"
-if [ -f /var/account/acct ]; then
- mv -f /var/account/acct.2 /var/account/acct.3
- mv -f /var/account/acct.1 /var/account/acct.2
- mv -f /var/account/acct.0 /var/account/acct.1
- cp -f /var/account/acct /var/account/acct.0
+
+next_part "System accounting records:"
+acct='/var/account/acct'
+[[ -f ${acct} && -s ${acct} ]] &&
+{
+ [[ ${VERBOSESTATUS} == '0' ]] ||
+ {
+ printf "%s%8s%9s%7s%7s\n" 'COMMANDS' 'TIME' 'I/O' 'CORE' 'USER'
+ sa -mi | awk '{ printf "%8d%8.2f%9d%7d %-s\n", $2, $3, $4,
$5, $1 }'
+ }
+
+ # For rotation by newsyslog:
+ cp -p ${acct} ${acct}.bak
+
+ # Truncate & summarise merge the accounting file
sa -sq
-fi
+}
# If ROOTBACKUP is set to 1 in the environment, and
# if filesystem named /altroot is type ffs and mounted "xx",
Index: newsyslog.conf
===
RCS file: /cvs/src/etc/newsyslog.conf,v
retrieving revision 1.33
diff -u -p -r1.33 newsyslog.conf
--- newsyslog.conf 27 Aug 2014 13:46:32 - 1.33
+++ newsyslog.conf 3 Aug 2015 10:15:52 -
@@ -16,3 +16,4 @@
/var/log/pflog 600 3 250 * ZB "pkill -HUP -u
root -U root -t - -x pflogd"
/var/www/logs/access.log 644 4 *$W0 Z "pkill -USR1 -u
root -U root -x httpd"
/var/www/logs/error.log644 7 250 * Z "pkill
-USR1 -u root -U root -x httpd"
+/var/account/acct.bak 644 7 1* ZB
