system accounting sa command error converting user accounting stats

Question

Level 1

4 points

system accounting sa command error converting user accounting stats

after enabling system accounting (underlying BSD os features) with "sudo accton /var/account/acct", daily attempts to summarize and rotate data into /var/account/savacct and ...usracct fails. these files were created by /usr/sbin/sa, and later runs of /usr/sbin/sa -s -q fail with an error

"sa: converting user accounting stats: Inappropriate file type or format"

"sa: user accounting initialization failed"

is there some bug being tracked with /usr/sbin/sa or do I need to file one?

macbook, Mac OS X (10.6)

Posted on Jan 9, 2012 9:40 AM

Reply

Answer 1

Linc Davis

Level 10

209,739 points

Jan 9, 2012 1:02 PM in response to mike142wood

It works for me. Did you create the 'acct' file?

Reply

Answer 2

mike142wood Author

Level 1

4 points

Jan 11, 2012 7:55 AM in response to Linc Davis

The 'acct' file exists and is accumulating stats. Each 'daily' run (/etc/periodic/daily/310.accounting) successfully copies the file to 'acct.0' but the next action of summarizing and emptying the acct file (sa -s -q) fails because some file is declared to have "inappropriate file type or format". 'file' says the summary files {sav,usr}acct are of type "Berkeley DB 1.85/1.86 (Btree, version 3, little-endian)" If they are deleted, 'sa -s -q' will create new ones, but subsequent runs of 'sa -s -q' will again fail. 'sa' appears to write files which it does not know how to read.

'/usr/sbin/sa' file is size 96736 dated Jun 16 2011. OS is 10.6.8 and Software Update claims all is up to date. Do you have a different OS (Lion?) or a different 'sa' ?

Reply

Answer 3

Linc Davis

Level 10

209,739 points

Jan 11, 2012 8:25 AM in response to mike142wood

It sounds like your 'sa' process is running in Rosetta. What do you get from "file -b /usr/sbin/sa" and "codesign -vv !$" ?

Reply

Answer 4

mike142wood Author

Level 1

4 points

Jan 11, 2012 9:39 AM in response to Linc Davis

Are you running Lion? I've got SnowLeopard (10.6.8)

Universal... should not be invoking Rosetta

% file -b /usr/sbin/sa

Mach-O universal binary with 3 architectures

/usr/sbin/sa (for architecture x86_64): Mach-O 64-bit executable x86_64

/usr/sbin/sa (for architecture i386): Mach-O executable i386

/usr/sbin/sa (for architecture ppc7400): Mach-O executable ppc

% codesign --verbose=9 --verify /usr/sbin/sa

/usr/sbin/sa: valid on disk

/usr/sbin/sa: satisfies its Designated Requirement

Reply

Answer 5

Linc Davis

Level 10

209,739 points

Jan 11, 2012 9:47 AM in response to mike142wood

I'm running Lion, but it worked in SL. Try this:

sudo -s
/usr/sbin/accton
rm /var/account/*acct
touch /var/account/acct
/usr/sbin/accton !$
exit
/usr/sbin/sa

Reply

Answer 6

mike142wood Author

Level 1

4 points

Jan 11, 2012 2:52 PM in response to Linc Davis

Above indeed works; file /var/account/acct begins accumulating stats and running 'sa' command shows them.

The problem is when running 'sa -s -q' daily to roll the individual records into summary count files /var/account/{sav,usr}acct; the first time creates those files and empties the .../acct file but the second and following times fail with the error lines:

sa: converting user accounting stats: Inappropriate file type or format

sa: user accounting initialization failed

After above setup steps you sent, try this:

sudo -s

/usr/sbin/sa -s -q

# observe that the files /var/account/{sav,usr}acct are newly created; now wait a bit and:

/usr/sbin/sa -s -q

# observe failure (at least, that's what I get)

(by the way Linc, thanks for all the digging you've done)

Reply

Answer 7

Linc Davis

Level 10

209,739 points

Jan 11, 2012 4:20 PM in response to mike142wood

I have no way of reproducing the problem, because I no longer use 10.6. Maybe it's a bug, or maybe you need to reinstall the OS. I don't know which.

Reply

Answer 8

mike142wood Author

Level 1

4 points

Jan 12, 2012 8:09 AM in response to Linc Davis

Linc, thanks for your checking. If I find some explanation, I'll try to update this.

Reply

Answer 9

athey3

Level 1

0 points

Feb 29, 2012 11:01 AM in response to mike142wood

I am having the same problem on 10.6.8. I have narrowed it down to the usracct file being corrupted by the "sa -s" command. If I stop accounting, remove the /usr/account/ files and start accounting I can then run "sa -s" successfully, once. After running it once I then get the errors. If I remove the usracct file and then run "sa -s" it runs successfully, only once of course.

This sure looks like a bug. Has anyone found out if there is a work-around or fix?

Reply