process accounting

[Justin Pryzby <justinpryzby@users.sourceforge.net>]

Does anyone know why process accounting seems to be completely broken?

I have acct installed, (as well as sac), and I just moved
/var/account/pacct out of the way and touch,chown,chmod a new one.  I
restarted acct (/etc/init.d/acct restart).  The kernel apparently
wrote some new information to that file, but it still isn't useful:

$ sa -u
34826      0.00 cpu        0k mem   2385 io D               
34826      0.00 cpu        0k mem     49 io �               
               *cpu        0k mem     49 io h
               *cpu        0k mem     49 io h

I assume that that's supposed to be the process name and not an
unprintable character.

strings /var/account/pacct shows all sorts of process names, none of
which I've ever seen with sa.

rawtmp shows some actually information, including usernames,
hostnames, times, pts numbers and PIDs, but I guess thats just using
wtmp and not pacct.

dumpacct shows seemingly random times from 1969..

Thanks, and Please Cc me,
Justin