Bug#3251: accounting file corruption
Package: acct
Version: 6.2-0
I just had a system crash which resulted in a total lockup of the disk
containing my /var partition (for complicated reasons I won't go into
here).
When the system was rebooting I noticed a message from fsck about
inode such-and-such having an incorrect length; fsck set the length to
`counted', presumably to be equal to the total length of the allocated
blocks.
After the reboot I checked which file was involved. It was
/var/account/pacct, and the length it had been set to was not a
multiple of 52 (the accounting record length).
This meant that the file was essentially useless - it didn't just have
some bogus data written around the crash, but all the data on the
`wrong' side of the crash was out of step. I recovered the situation
as best I could by turning accounting off, truncating the file, and
then turning it back on.
I'd like accton (or perhaps the init.d scripts that call it) to check
that the file has a sensible length and do something appropriate if it
hasn't - pad it with nulls or truncate the partial record would do;
failing altogether would be better than producing an entirely
corrupted file.
Ian.
Reply to: