[ On Tuesday, August 5, 2003 at 11:53:26 (-0700), Greywolf wrote: ]
> Subject: Compress accounting?
>
> I have a patch to /etc/daily which will enable the proper
> compression/moving of accounting files resulting in a SIGNIFICANT space
> savings.

The original accounting script is broken and thus your attempt to fix it
cannot succeed.

There is currently no need to, and no way to safely, keep previous
copies of the a archived accounting records.

Only 'sa' (or some other tool that can truncate the file to the point
up to where it was read) can safely access the live accounting file.

This is the only safe way the accounting file can be handled at this time:

if checkyesno summarize_accounting && [ -f /var/account/acct ]; then
	echo ""
	echo "Summarizing live accounting records:"
	#
	# load any existing summary files, merge live records into the
	# summary truncate the live accounting file (hopefully to the
	# point it was read), and write the accumulate summaries out
	# again.  (/var/account/savacct and /var/account/usracct)
	#
	# XXX it would be nice if 'sa' had an option that would allow
	# it to copy all the raw records it reads to another file so
	# that they could also be preserved in case they need to be
	# re-processed (or for forensics).
	#
	sa -slq
fi



-- 
						Greg A. Woods

+1 416 218-0098                  VE3TCP            RoboHack <woods@robohack.ca>
Planix, Inc. <woods@planix.com>          Secrets of the Weird <woods@weird.com>