On Sat, Nov 12, 2005 at 04:21:38PM +0001, Jason McIntyre wrote:
> On Thu, Nov 10, 2005 at 06:56:46AM +0100, Andreas Bihlmaier wrote:
> > Hello misc@,
> >
> > a question that bugged me for quite a while:
> >
> > Why is the accounting in /etc/monthly?
> > I reffer to these (commented out) lines:
> >
> > #echo ""
> > #echo "Doing login accounting:"
> > #ac -p | sort -nr +1
> > #
> > #echo "."
> >
> > If I uncomment them (as suggested in "Absolute OpenBSD" to get some basic
> > accounting (or just to find out HOW much time I spend in front of the
> > screen).
> >
> > I get a report ever month, BUT now the problem:
> >
> > The way I read "man 8 ac" it states
> > <quote>
> > The default wtmp file will increase without bound unless it is truncated.
> > It is normally truncated by the daily scripts run by cron(8), which re-
> > name and rotate the wtmp files, keeping a week's worth of data on hand.
> > No login or connect time accounting is performed if /var/log/wtmp does
> > not exist.
> > </quote>
> >
>
> note that the man page was a little confusing here, since it sounds like
> the /etc/daily script controls wtmp size. rather newsyslog does this. i
> have just committed a fix to the page to clarify that.
>
> > Doesn't this mean that I only get accounting for the last week of the month?
> > Shouldn't the lines above moved to /etc/weekly?
> > Did I miss something, or is this the intended behavior (for what reason)?
> >
>
> that's right. i just moved the ac(8) stuff from /etc/monthly to
> /etc/weekly. of course you could also adjust newsyslog to rotate wtmp
> less often.
>
> jmc
wtmp is rotated every 7 days by newsyslog. It's the same frequency
has /etc/weekly but they are totally unrelated events.
If someone wants to use "ac" in /etc/{weekly,monthly}, he _has_ to
change the wtmp entry in newsyslog.conf.
The not proper method but the easyest is to make the log rotate an
hour after the scripts are run. That way you know you have almost
the right amount of data for "ac" at the time the script is running.
For weekly something like: $W6D4
For monthly: $M1D6
(I did not test. If "ac" is to be run before updatedb in weekly,
it is easier to guess when it will be run than after updatedb.)
The proper method would be to run "ac" at the same time wtmp is
rotated. (Either weekly/monthly rotates the file or newsyslog runs
a command to mail an "ac" report.)
--
Hugo Villeneuve <[EMAIL PROTECTED]>
http://EINTR.net/
