wtmpx truncated by accounting?

[dUbbsNIX]

Hi,

I was told to switch on process accounting. Problem is each night at 0230, the runacct in the adm crontab appears to truncate it. This is annoying as now the last command will only report information from the same day. We need to keep a months worth really.

Any ideas, don't want to have to stop running runacct

Dave.

 

[KenCunningham]

Doesn't it put the part it's truncated into a new file?

 

[dUbbsNIX]

The problem is using the last command, with last you can use the -f switch to point to a different file, so I can use that to point at the owtmpx file which has the previous days info. But really we want to use last and get a months worth.
I am thinking about setting up a cron job to run after runpacct, to save off the owtmpx and append it to another file. I guess I have to make it asci first etc.
I guess their rationale is that last should be used only to see the last time a user logged in, but if they have logged in more than a day ago, the info is lost.

I was hoping I could confgiure account not to truncate the wtmpx file with an option, or alternate method to gleen the same info.

cheers,

D.

 

[KenCunningham]

I think your cron job idea sounds reasonable, but I would have thought there's no need for an ascii conversion - I imagine last would be happier with the native file type.

 

[dUbbsNIX]

Sorry, I meant convert to asci in order that I'll be able to append it to another acsi file, which itself would then be converted back for last(1) to read it.

 

[dUbbsNIX]

There was no need to convert to asci in the end to append the new file "archived" wtmpx. The script, below, was written and placed in cron to run at 0300hrs 30 mins after process acounting.

Now I can run the following command;

last -f /var/adm/ARCwtmpx

to get information older than a day.

#!/bin/ksh
#
# wtmpx_save
#
# Script to append previous days wtmpx file to a central file that may be used
# with the last(1) command to provide 31 days worth of information
#
# The script should be called by cron(1M) following successful completion of
# overnight process accoutning
#
export NITE_DIR=/var/adm/acct/nite
export PREV_FILE=${NITE_DIR}/owtmpx
export ARC_FILE=/var/adm/ARCwtmpx

# Check that the wtmpx component of overnight accounting has completed okay

WTMPX_STAT=`(grep -i "wtmpx processing complete" ${NITE_DIR}/active | wc -l)`

if [ $WTMPX_STAT = 0 ]
then
logger -p cron.error "Archiving of wtmpx not run: Possible problem with SYSTEM ACCOUNTING?" ; exit 1
else

# Cat the previous days infomration and append it out archive file
cat $PREV_FILE >> $ARC_FILE
exit 0
fi