[See below for a comment regarding #51796 ("wtmp is rotated before the
report (logrotate?)").]
[Quotes "regenerated" from original mails to provide context.]
> > * Fabian Pietsch <[EMAIL PROTECTED]> (Wed, 24 Aug 2005 21:08:45 +0200):
> > > In /etc/cron.monthly/acct, a monthly report of system and user activity
> > > logged in the wtmp file is generated; part of this is the following:
> > >
> > > if [ -f $LOGROTATE ] && [ -x /usr/sbin/logrotate ]
> > > then
> > > [...]
> > > ac -f $WTMP /var/log/wtmp.1 -p | sort -nr +1 >>
> > > /var/log/wtmp.report
> > > [...]
> > > else
> > > ac -p | sort -nr +1 >> /var/log/wtmp.report
> > > [...]
> > > fi
> > >
> > > In the second case, the invocation of ac would summarize connect/login
> > > times for all users; in the first, it would do likewise for the user
> > > /var/log/wtmp.1 which doesn't exist, so the only ac output will be:
> > >
> > > total 0.00
> > >
> > > The additional parameter to ac seems to have been left when $WTMP was
> > > introduced, probably in a fix in acct-6.3.5-38.2, and should most
> > > probably be removed to restore functionality.
>
> * Sam Morris <[EMAIL PROTECTED]> (Tue, 12 Sep 2006 10:20:06 +0100):
> > I think that the additional processing of wtmp.1 must be left in to take
> > account of log rotation (see #51796). I found that putting an additional
> > '-f' parameter before '/var/log/wtmp.1' caused ac to process both files.
[Unfortunately I didn't get the above follow-up to my bug report as I
was only the reporter, not subscribed to the bug nor manually kept in
the loop...]
* Debian Bug Tracking System <[EMAIL PROTECTED]> (Sat, 04 Nov 2006 05:03:39
-0800):
> Subject: Bug#324910 closed by Daniel Baumann <[EMAIL PROTECTED]>
> (Bug#324910: fixed in acct 6.4~pre1-1)
>
> This is an automatic notification regarding your Bug report
> #324910: /etc/cron.monthly/acct typo results in no meaningful ac output in
> /var/log/wtmp.report if logrotate is installed,
> which was filed against the acct package.
>
> It has been closed by Daniel Baumann <[EMAIL PROTECTED]>.
>
[...]
>
> Changes:
> acct (6.4~pre1-1) unstable; urgency=medium
> .
[...]
> * Updated ac call in cron.monthly to process both $WTMP and /var/log/wtmp.1
> (Closes: #324910).
I believe $WTMP already contains "/var/log/wtmp.1" if it exists, and the
name of an uncompressed temporary copy of a wtmp.1.gz if that exists
instead. See below for the full quote of what had been shortened above.
Taken from acct-6.4~pre1-1's debian/cron.monthly:
| if [ -f "${LOGROTATE}" ] && [ -x /usr/sbin/logrotate ]
| then
| if [ -f /var/log/wtmp.1 ]
| then
| WTMP="/var/log/wtmp.1"
| elif [ -f /var/log/wtmp.1.gz ]
| then
| WTMP_WAS_GZIPPED="1"
| WTMP="`tempfile`"
|
| gunzip -c /var/log/wtmp.1.gz > "${WTMP}"
| fi
|
| ac -f "${WTMP}" -f /var/log/wtmp.1 -p | sort -nr -k2 >>
/var/log/wtmp.report
| echo >> /var/log/wtmp.report
| last -f "${WTMP}" >> /var/log/wtmp.report
|
| if [ -n "${WTMP_WAS_GZIPPED}" ]
| then
| # remove temporary file
| rm -f "${WTMP}"
| fi
| else
| ac -p | sort -nr -k2 >> /var/log/wtmp.report
| echo >> /var/log/wtmp.report
| last >> /var/log/wtmp.report
| fi
Therefore it seems to me that as of acct-6.4~pre1-1, /var/log/wtmp.1
will be processed twice in some cases. I still suggest the correct fix
for the first occurrence of ac in the above snippet would be:
] ac -f "${WTMP}" -p | sort -nr -k2 >> /var/log/wtmp.report
As for #51796, it might well be possible that the empty report is caused
by the same superflous explicit occurrence of "/var/log/wtmp.1" (parsed as
username by ac), as in my original report -- and therefore not caused
by log rotation order, as suggested by #51796's bug title
("wtmp is rotated before the report (logrotate?)").
Or perhaps the whole point of the $WTMP indirection in this script was
to fix #51796, but didn't really fix it because of the leftover explicit
/var/log/wtmp.1 ;)
Regards, Fabian
--
Fabian "zzz" Pietsch - http://zzz.arara.de/
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
