process accounting

Justin Pryzby · *nix forums beginner Joined: 14 Mar 2005 Posts: 23

Does anyone know why process accounting seems to be completely broken?

I have acct installed, (as well as sac), and I just moved
/var/account/pacct out of the way and touch,chown,chmod a new one. I
restarted acct (/etc/init.d/acct restart). The kernel apparently
wrote some new information to that file, but it still isn't useful:

$ sa -u
34826 0.00 cpu 0k mem 2385 io D
34826 0.00 cpu 0k mem 49 io �
*cpu 0k mem 49 io h
*cpu 0k mem 49 io h

I assume that that's supposed to be the process name and not an
unprintable character.

strings /var/account/pacct shows all sorts of process names, none of
which I've ever seen with sa.

rawtmp shows some actually information, including usernames,
hostnames, times, pts numbers and PIDs, but I guess thats just using
wtmp and not pacct.

dumpacct shows seemingly random times from 1969..

Thanks, and Please Cc me,
Justin

--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Justin Pryzby · *nix forums beginner Joined: 14 Mar 2005 Posts: 23

Nevermind; Linux 2.6 has "version 3" process accounting, which I have
enabled. It requires updated tools to grok that information, which
Debian apparently does not support (yet). There's a URL for
updated/rewritten packages, and a wishlist bug for v3 support:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=289648

Justin

On Sun, Feb 06, 2005 at 12:12:04AM -0500, pryzbyj wrote:

Google