[Bug 50052] Re: kernel is unmatched with userspace accounting tools

[Ryan Lovett]

** Description changed:

  Binary package hint: linux-image-2.6.12-10-686-smp
  
  With linux-image-2.6.12-9-686-smp, the utilities provided with the acct
  package worked fine. With the latter kernel, 'lastcomm' cannot parse the
  structure anymore:
  
  $ lastcomm | tail
  ??                S     root     ??         0.16 secs Wed Dec 31 16:00
  ??                S     root     ??         0.16 secs Wed Dec 31 16:15
  8?                      root     ??         0.16 secs Wed Dec 31 16:15
  ??                S     root     ??         0.16 secs Wed Dec 31 16:00
  ??                S     root     ??         0.16 secs Wed Dec 31 16:15
  ??                      root     ??         0.16 secs Wed Dec 31 16:15
  ??                 F    root     ??         0.00 secs Wed Dec 31 16:00
  ??                S     root     ??         0.00 secs Wed Dec 31 16:00
  ??                      root     ??         0.00 secs Wed Dec 31 16:00
  x?                S     root     ??         0.00 secs Wed Dec 31 16:00
  $ date
  Fri Jun 16 15:18:05 PDT 2006
  $ dpkg -l acct | grep acct
  ii  acct           6.3.5-39       The GNU Accounting utilities for process and login accounting
  
  I tried stopping accounting, putting an empty pacct file in place, and
  restarting it, but the kernel still writes out incongruent data. Since
  the acct package hasn't changed, the kernel must now be writing out a
  modified structure.
+ 
+ This is also a security problem since we no longer have an accurate
+ record of which process ran when.

-- 
kernel is unmatched with userspace accounting tools
https://launchpad.net/bugs/50052