kern/167321: [sysctl] [patch] Implement sysctl to control kernel accounting log messages (e.g. acct(2))

[Jeremy Chadwick]

On Thu, Apr 26, 2012 at 09:30:01AM -0400, John Baldwin wrote:
> Hmm, reading the rc.d script and the kernel code, it is not clear to me why 
> you are seeing "Accounting disabled" messages at all.  You should be seeing 
> two "Accounting enabled" messages, but no disabled.

Taken from our logs on one box (but they all show the same behaviour):

/var/log/messages:Apr 26 00:39:47 ra kernel: Accounting enabled
/var/log/messages:Apr 26 03:01:00 ra kernel: Accounting disabled
/var/log/messages:Apr 26 03:01:00 ra kernel: Accounting enabled
/var/log/messages:Apr 26 03:01:00 ra kernel: Accounting disabled
/var/log/messages:Apr 26 03:01:00 ra kernel: Accounting enabled
/var/log/messages:Apr 26 04:38:40 ra kernel: Accounting disabled

00:39 = when we enabled accounting for the very first time
03:01 = entries caused by periodic script
04:38 = when we disabled accounting due to this problem.

> However, it seems that the 'rotate_log' command in
> /etc/rc.d/accounting can be simplified.  The kernel doesn't care about
> the pathname, so it doesn't need to have accton re- run when the file
> is renamed from its temporary filename to it's full name.
> 
> You could then update the acct() system call to not log the message
> when accounting is switched from one file to another atomically.  I
> think these two changes will address your problem while preserving the
> useful logging:

Your kernel patch looks a *lot* more elegant and logical (yep I
understand it :-) ).  I'll give it a try on my home machine here and
report back the results.  Might be a few days though given health
problems and doctors visits going on.

Thanks as usual, John!

-- 
| Jeremy Chadwick                                   jdc at koitsu.org |
| UNIX Systems Administrator                http://jdc.koitsu.org/ |
| Mountain View, CA, US                                            |
| Making life hard for others since 1977.             PGP 4BD6C0CB |


> Index: etc/rc.d/accounting
> ===================================================================
> --- etc/rc.d/accounting	(revision 234685)
> +++ etc/rc.d/accounting	(working copy)
> @@ -65,9 +65,7 @@
>  	mv ${accounting_file} ${accounting_file}.0
>  
>  	if checkyesno accounting_enable; then
> -		ln $_file ${accounting_file##*/}
> -		${accounting_command} ${accounting_file}
> -		unlink $_file
> +		mv $_file ${accounting_file}
>  	fi
>  }
>  
> Index: sys/kern/kern_acct.c
> ===================================================================
> --- sys/kern/kern_acct.c	(revision 234685)
> +++ sys/kern/kern_acct.c	(working copy)
> @@ -297,9 +297,11 @@
>  			return (error);
>  		}
>  	}
> -	acct_configured = 1;
> +	if (!acct_configured) {
> +		acct_configured = 1;
> +		log(LOG_NOTICE, "Accounting enabled\n");
> +	}
>  	sx_xunlock(&acct_sx);
> -	log(LOG_NOTICE, "Accounting enabled\n");
>  	return (error);
>  }
>  
> 
> -- 
> John Baldwin