Lots of accounting data

[Christopher Cowart]

Dan Nelson wrote:
>> I only really see two options, neither of which I particularly like:
>>   * Throw more disk at the problem (but given what I've seen, I don't
>>     like the odds that within a month or two, I'll realize I didn't give
>>     it enough).
>>   * Turn off accounting on these boxes.
> 
>  * edit /etc/periodic/daily/310.accounting to keep less historical
>    copies of acct.
> 
>  * edit /sys/kern/kern_acct.c to not write accounting records for the
>    squid userid.
> 
>  * Mount a ZFS filessytem on /var/account/ with compression enabled. 
>    Even lzjb compression will get you 3:1 compression on the acct
>    files; gzip-1 should get you even more.

Thank you for the extra suggestions. 

I've uncovered the root cause of the problem. It's documented in
bin/120293: [patch] sa(8) fails to summarize/truncate accounting data.

It appears that the daily execution of `sa -s -q' is *not* actually
sumarizing the data, and thus not truncating the file. As such,
/var/account/acct is growing without bound -- not being restored to a
size of 0 after the periodic run. This is a bug in sa(8).

Will this patch be MFCd to 7.0 as an errata? Should somebody submit a
request to re@?

-- 
Chris Cowart
Network Technical Lead
Network & Infrastructure Services, RSSP-IT
UC Berkeley
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20080813/467d32de/attachment.pgp