HEADS UP: new accounting file format
Diomidis Spinellis
dds at aueb.gr
Wed Apr 18 17:49:34 UTC 2007
You can skip the rest of this email if you are NOT running process
accounting or if you don't care about your old accounting files.
On April 21st I will commit to the FreeBSD kernel and user programs a
new format of accounting files - acct(5). This change (discussed in
-arch) will provide microsecond precision to time values, simplify the
storage of time values, and provide extra range for overflowing fields.
This change will render incompatible the existing acct(5) files and the
condensed summary files /var/account/savacct and /var/account/usracct.
Although from the state of the process accounting system I guess that it
has become mostly useless for its purpose over the years, it was pointed
to me that some installations run accounting as a way of auditing
command and resource usage. Such installations would presumably want to
keep access to existing accounting files.
For this reason I have committed a new version of lastcomm(1) that can
export the contents of an accounting file in text format. If your
installation requires access to old accounting files, I recommend:
1) to compile this file and keep a binary in a safe place
2) to export your accounting files into text format. You can do this
with a command like
lastcomm -X -f acctfile >acctfile.txt
After the April 21st change you will be able to import the text
accounting files into the new file format (I have already tested this
functionality), and also use the old binary to inspect and export those
old files.
I have made no provision for updating the condensed summary files
/var/account/savacct and /var/account/usracct. If your process
accounting system relies on them, you will need to save their contents
in a readable format before the switch.
Diomidis Spinellis - http://www.spinellis.gr
More information about the freebsd-current
mailing list