Lots of accounting data
ccowart at rescomp.berkeley.edu
Wed Aug 13 20:31:42 UTC 2008
Dan Nelson wrote:
>> I only really see two options, neither of which I particularly like:
>> * Throw more disk at the problem (but given what I've seen, I don't
>> like the odds that within a month or two, I'll realize I didn't give
>> it enough).
>> * Turn off accounting on these boxes.
> * edit /etc/periodic/daily/310.accounting to keep less historical
> copies of acct.
> * edit /sys/kern/kern_acct.c to not write accounting records for the
> squid userid.
> * Mount a ZFS filessytem on /var/account/ with compression enabled.
> Even lzjb compression will get you 3:1 compression on the acct
> files; gzip-1 should get you even more.
Thank you for the extra suggestions.
I've uncovered the root cause of the problem. It's documented in
bin/120293: [patch] sa(8) fails to summarize/truncate accounting data.
It appears that the daily execution of `sa -s -q' is *not* actually
sumarizing the data, and thus not truncating the file. As such,
/var/account/acct is growing without bound -- not being restored to a
size of 0 after the periodic run. This is a bug in sa(8).
Will this patch be MFCd to 7.0 as an errata? Should somebody submit a
request to re@?
Network Technical Lead
Network & Infrastructure Services, RSSP-IT
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Size: 833 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20080813/467d32de/attachment.pgp
More information about the freebsd-questions