/var/log/account/pacct is getting too big, where is ckpacct (to cicle/gzip it)?
I got 2 big files at, /var/log/account, of 350MB each..., my root is only 10GB...
I read there could have ckpacct to cycle and gzip it, but I cant find it, also no alternative command?
EDIT: I found that sudo accton off disable the logging but the files remain there, and I guess my next boot it will be activated again...
They seem to are being cycled but who actually does it?
369114432 May 13 23:23 /var/log/account/pacct
333708160 May 13 12:27 /var/log/account/pacct.0 13681065 May 12 16:21 /var/log/account/pacct.1.gz 3371433 May 11 09:50 /var/log/account/pacct.2.gz 7549333 May 10 07:35 /var/log/account/pacct.3.gzEDIT: my guess boot scripts does the cycle... anyway, I created this script, but I dont know what safety implications it may have.. any considerations?
cat >ckpacct.sh
#!/bin/bash
if [[ -n "$1" ]]; then echo "there is no parameters and no --help, read the script and understand what is does, before running it up." exit 1
fi
if [[ "$USER" != "root" ]]; then echo "you must be root to run it..." exit 1
fi
function FUNCerror() { if(($1!=0));then exit 1; fi
}
cd /var/log/account;FUNCerror $? || exit
# fast ungrab pacct file
accton off;FUNCerror $?
mv -v pacct pacct.0.temp;FUNCerror $?
echo -n |tee pacct;FUNCerror $?
chown -v root:adm pacct;FUNCerror $?
chmod -v o-r pacct;FUNCerror $?
accton on;FUNCerror $?
# compress old 0
gzip -v --best pacct.0;FUNCerror $? #releases also pacct.0 filename
mv -v pacct.0.temp pacct.0;FUNCerror $? #restore new 0 from temp
# change file names upping indexes
#mv -v pacct pacct.0
for((i=4;i>=0;i--));do mv -v pacct.$i.gz pacct.$((i+1)).gz;FUNCerror $?
done
rm -v pacct.5.gz;FUNCerror $? # remove last in the limit3 Answers
The script that cycles the logs is in /etc/. The number of log files is controlled by /etc/default/acct, which also controls whether process accounting should be enabled at boot time.
If you want to entirely remove process accounting, sudo apt-get purge acct should do the trick too.
Get the acct cron to cron.hourly instead of daily. Then, put this values in /etc/default/acct:
ACCT_ENABLE="1"
# Amount of days that the logs are kept.
ACCT_LOGGING="2" # you cannot set this less than 2 # if you don't want acct to get an errorI realize that this is an old question, but since it wasn't answered...
I would assume that logrotate is doing your log rotation. Check your crontab ("crontab -l") for a logrotate task that identifies the conf file. Look in that conf file for details related to /var/log/account/pacct.
I didn't read your script closely, but it seems like your duplicating what logrotate does - no?
3
