Enable accounting

[joe_91]

There are some REDS being generated by security s/w for not enabling accounting. we want to enable it but at the same time do not want the logs to grow..in short we are just intrested in getting these RED flags off.How do i start accounting by command line? And also i need the log files to be always 0. I have edited the rc.config.d/acct file to set it to 1. Pl advise.

Thanks

Joe.

[A. Clay Stephenson]

If I understand your question, you want accounting to APPEAR to be running when it is not. Be glad, I'm not auditing your site.

After you have set the /etc/rc.config.d/acct entry START_ACCT=0

you then can manually execute
/sbin/init.d/acct start to start accounting
and
/sbin/init.d/acct stop to shutdown accounting.

[joe_91]

Clay:

I am going to have 1 in /etc/rc.config.d/acct 'coz i want it to run on reboot. I wanted to know how i would disable the log files or Rather have the log files as 0 so that it would not grow.

Thanks

Joe

[A. Clay Stephenson]

In that case, I'll give you some hints. Man acctsh and pay attention to the turnacct and ckpacct sections. You should be able to cron a daemon to remove /var/adm/pacctNNN files while leaving the current file /var/adm/pacct (no suffix) in place and ckpacct will keep it at a reasonably small size but you will still be able to generate some data for your auditors.