Lots of accounting data

[Brie Gordon]

On Wed, Aug 13, 2008 at 3:03 PM, Christopher Cowart
<ccowart at rescomp.berkeley.edu> wrote:
> Bill Moran wrote:
>> In response to Christopher Cowart <ccowart at rescomp.berkeley.edu>:
>>> I only really see two options, neither of which I particularly like:
>>>   * Throw more disk at the problem (but given what I've seen, I don't
>>>     like the odds that within a month or two, I'll realize I didn't give
>>>     it enough).
>>>   * Turn off accounting on these boxes.
>>
>> * Rotate and compress more frequently; and store less history?
>
> The compressed history amounts to nothing in comparison (1.5GB per file
> as opposed to 17GB). I suppose I could configure our hourly logrotate to
> replace the functionality of /etc/periodic/daily/310.accounting. Sounds
> like a viable solution to me.
>
> Thanks,
>
> --
> Chris Cowart
> Network Technical Lead
> Network & Infrastructure Services, RSSP-IT
> UC Berkeley
>

Could you dedicate a server to holding logs? (In addition to the compression?)

-- 
Regards,

Brie A. Gordon
A Linux Chica

http://granite.sru.edu/~bag6849/index.html