In kernels 4.x the command "accton /var/account/pacct" not always turn process accounting on: episodically the system silently stop recording accounting records and the message "Process accounting resumed" doesn't appear in the dmesg log. This is really a problem when time to "logrotate" the /var/account/pacct time comes: the accounting system is silently stopped and it will never be restarted by logrotate because the pacct file remain empty forever. I tried to track the problem by myself and it seems to me is not really located in the sys-process/acct package but actually in the linux kernel. I can be wrong, so let me try starting from here. For what I can see the source file "kernel/acct.c" changed from kernels 3.x, where accounting never had a problem, and at line kernel/acct.c[240], gentoo-sources-4.0.9 kernel (it is the same line in all 4.x kernels I've seen so far), we have acct->needcheck = jiffies; that should have been instead initialized to acct->needcheck = jiffies + ACCT_TIMEOUT*HZ; I tried to patch the gentoo 4.0.9 kernel by myself and the problem is gone, for what I can see. Wondering about what to do now with this small patch, beside manually applying it to each new kernel. Regards G. Vitillaro.
Fix present in current kernels
Sorry to open again an "old thread", but there is something, now, I don't understand. For what I can see, reading https://lkml.org/lkml/2017/12/13/408 the bug has been fixed by upstream only recently, found in the source kernel/acct.c, line 102: if (time_is_before_jiffies(acct->needcheck)) goto out; had to be if (time_is_after_jiffies(acct->needcheck)) goto out; and infact, now, and only now, with last stable kernel 4.9.76-r1, accounting has started to work correctly, without user patches applied. Even in recent kernels, as 4.14.12, the bug is still there, as you may easily verify at line 102 of kernel/acct.c. My question. How this bug may have been closed almost one year ago? Thanks, G. Vitillaro.
