Accounting.Txt

File contents

Date: Mon, 14 Mar 2011 09:51:24 -0600
To: emulab-admins@googlegroups.com

Just a note for anyone who has upgraded FreeBSD from an earlier version to 7.3.
We noticed (after our /var kept filling up), that the accounting logs in
/var/account were continuously growing:

1230576 -rw-r--r--   1 root  wheel  1259772816 Mar 14 09:17 acct
1228304 -rw-r--r--   1 root  wheel  1257452304 Mar 14 03:01 acct.0
1216880 -rw-r--r--   1 root  wheel  1245744400 Mar 13 03:01 acct.1
1199600 -rw-r--r--   1 root  wheel  1228047248 Mar 12 03:01 acct.2
1183744 -rw-r--r--   1 root  wheel  1211818512 Mar 11 03:01 acct.3
1162608 -rw-r--r--   1 root  wheel  1190194512 Mar 10 03:01 acct.4
1146912 -rw-r--r--   1 root  wheel  1174112784 Mar  9 03:01 acct.5

to the point of absurdity.  They are supposed to be getting rolled and
truncated every day, but clearly there were not (we are busy, but not THAT
busy).

Apparently, there was some anomaly at upgrade time that caused a bad
record to be inserted and this was causing "sa" (the program that summarizes
and truncates the log) to fail.  So if your logs are ever-growing, go into
/var/account (on both boss and ops) and do:

    sudo accton
    sudo cp /dev/null accton
    sudo accton /var/account/acct

and then get rid of the acct.[12345] files. You can leave acct.0 with the
"historical" log of everything that happened since the upgrade, if you care.
It appears that at least "lastcomm" can still read the entire log, even if
"sa" cannot.