Accounting question about pacct file

[Allan Campbell]

I am running HPUX 11.11 and am haveing problems with the accounting process "catch 22". I have the three cron jobs running (runacct, ckpacct, and monacct) as follows:

01 00 * * * /usr/sbin/acct/runacct 2> /var/adm/acct/nite/fd2log
10,20,30,40,50,00 * * * * /usr/sbin/acct/ckpacct
30 00 1 * * /usr/sbin/acct/monacct

The accounting is so heavy that every 10 minutes a new pacct* file is created. That is not the problem. The problem is when the runacct job runs I get an error in the fd2log that says "acctmerg: File limit exceeded". What that means is that there are too many pacct* files for the acctmerg command to process. I cannot use the ckpacct to make fewer files because I am told that the pacct file has a 2.5mb file limit size set by the kernel. This is a problem because the runacct job creates 0 length files that the monacct job tries to run. Then the monacct job fails. Any suggestions?

[Martin Johnson]

May may want to look into summarizing/merging some of the data to reduce the volume (see man acctprc or man acctmerg). This would require an analysis and redesign of the current process, which can be time consuming.

Or you may need to process every 12 hours instead of every 24 hours. A "quick fix", but you will need to verify this does not cause problems later in the process.

HTH
Marty

[Allan Campbell]

Running the runacct more often during the day will certainly help prevent the error, but this will only create a bigger problem. Now you are throwing away accounting information that was collected on the previous runs of runacct for the same date. The runacct program is takes the current pacct* files and creates a tacct file for the monacct program to use later. If you run more than one runacct on the same day, the subsequent run will simply overwrite the last tacct file. Without extensive rewriting the runacct program, this will also be counter productive. Any other ideas?

[Allan Campbell]

I have scripted what I think to be a bypass of the problem. I have set up in cron another job that runs just before the runacct job that combines the pacct* files into fewer files. The script is as follows:
for N in 1 2 3 4 5 6 7 8 9
do
ls pacct${N}? 2>/dev/null 1> /dev/null
_rc=$?
if test ${_rc} -eq 0; then
cat pacct${N}? > pacct${N}
rm pacct${N}?
fi
done
#
# Finally the over pacct99 files
# Note: the largest possible file is pacct144
#
ls pacct1?? 2>/dev/null 1> /dev/null
_rc=$?
if test ${_rc} -eq 0; then
cat pacct1?? > pacct10
rm pacct1??
fi
-----
This will create no more than eleven files that easily gets processed by runacct. Does anyone see a problem with this approach?