From owner-freebsd-stable  Sun Nov 12 14:13:55 2000
Delivered-To: freebsd-stable@freebsd.org
Received: from shell.futuresouth.com (shell.futuresouth.com [198.78.58.28])
	by hub.freebsd.org (Postfix) with ESMTP id 9B10537B479
	for <freebsd-stable@FreeBSD.ORG>; Sun, 12 Nov 2000 14:13:52 -0800 (PST)
Received: (from tim@localhost)
	by shell.futuresouth.com (8.9.3/8.9.3) id QAA10485;
	Sun, 12 Nov 2000 16:13:50 -0600 (CST)
Date: Sun, 12 Nov 2000 16:13:50 -0600
From: Tim Tsai <tim@futuresouth.com>
To: cjclark@alum.mit.edu
Cc: freebsd-stable@FreeBSD.ORG
Subject: Re: periodic and 310.accounting
Message-ID: <20001112161350.A8992@futuresouth.com>
References: <20001112075532.A7158@futuresouth.com> <20001112134724.O75251@149.211.6.64.reflexcom.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <20001112134724.O75251@149.211.6.64.reflexcom.com>; from cjclark@reflexnet.net on Sun, Nov 12, 2000 at 01:47:24PM -0800
Sender: owner-freebsd-stable@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

On Sun, Nov 12, 2000 at 01:47:24PM -0800, Crist J . Clark wrote:
> I wanted to point out that the "logs" are kept for much longer than
> three days. The raw accounting files are only kept for three days, but
> I believe that /var/account/savacct and /var/account/usracct are never
> touched by any of the distributed daily/weekly/monthly scripts. Your
> accounting information will be saved forever unless you remove it.

  savacct and usracct are just summary files though, right?  I was looking
for the login times of a particular user and I believe I need the raw log
files for that.

> > and
> > the much smarter way is the method used by /etc/newsyslog.conf.  Actually,
> > I'd prefer to use newsyslog.conf to handle the accounting files as well.
> 
> That is an interesting idea. The problem with that method is that you
> probably want to run a 'sa -s' command right when the logs are rotated
> in the same way newsyslog HUPs syslogd right after it does the
> rotations.

  True.  It'll work for me though since I don't care much for the summary
information anyway.  Also I meant to say that I'd prefer to use newsyslog
to handle the log files.  I don't actually want to lump them into
/etc/newsyslog.conf.  My script to run newsyslog could very well run sa
-s at the same time.

  It looks to me there is a small race condition with the 310.accounting
script.

    cp -pf acct acct.0 || rc=3
    sa -s >/dev/null || rc=3

  wouldn't commands logged between the two statements be lost?  I can't
think of a way to work around this though.  Or is there some special
system magic that I am missing?

> What version are you running? Have you seen the new
> /usr/local/etc/periodic/ insanity yet? Have a look at
> /etc/defaults/periodic.conf and the periodic script,
> /usr/sbin/periodic, to see how it all works.

  Thanks for the info.  I did not realize this was only introduced recently
and thanks to another pointer found it after updating to the latest
-stable.

  Tim


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-stable" in the body of the message