pacct huge

[ssaachi]

I have just taken over a new server and been told that pacct file is huge. Apparently Oracle writes numerous lines to process accounting /var/adm/pacct which fills up the filesys
We do not know what is writing to pacct. I need to know
1. How do I fix this problem ( customer is not ready to add addtional drives )
2. How can I get information what is writing to pacct
3. hoe can I read the data from pacct
please help. I am new to this and do not have much knowledge
thanks in advance

 

[ssaachi]

I also did a lastcomm and it is full of the entries ls , head, grep , sleep
ls ceadmin __ 0.01 secs Thu Aug 29 10:29
head ceadmin __ 0.02 secs Thu Aug 29 10:29
grep ceadmin __ 0.00 secs Thu Aug 29 10:29
ls ceadmin __ 0.01 secs Thu Aug 29 10:29
sleep ceadmin __ 0.01 secs Thu Aug 29 10:29
head ceadmin __ 0.01 secs Thu Aug 29 10:29
grep ceadmin __ 0.01 secs Thu Aug 29 10:29

 

[vkostovic]

Check this link out:

http://docs.sun.com/db?p=/doc/805-7229/6j6q8svg4&a=view

I hope it helps.

 

[ssaachi]

Thanks it gave me more information on process accounting.
I have one more question. I came across the following i.e making changes to runacct to eliminate duplicate accounting entries.
Do you know if accounting needs to be restarted for the new script to be effective.
Duplicate procees entries are being put in /var/adm/pacct. This can be seen by running `/bin/acctcom | uniq -d`. This occurs with or without accounting patch 100407-06 installed. E.G:

hood 17 % uname -a
SunOS hood 4.1.2 2 sun4
hood 16 % acctcom | uniq -d
compress gerhard ttyp0 09:00:13 09:00:13 0.18 0.07 0.00
du gerhard ttypb 09:00:14 09:00:14 0.03 0.02 0.00
du gerhard ttypb 09:00:15 09:00:15 0.02 0.02 0.00
compress gerhard ttyp0 09:00:15 09:00:15 0.27 0.07 0.00
compress gerhard ttyp0 09:00:18 09:00:18 0.28 0.07 0.00
....
....Work Around Top

You can pipe the output of acctcom, etc through `uniq -u`. Simularly
to correct the standard reports the following three additions of
"uniq -u" can be made to /usr/lib/acct/runacct.

hood% diff /usr/lib/acct/runacct /usr/lib/acct/runacct.old
232c232
< acctprc1 ctmp < ${_Spacct} | uniq -u |---
> acctprc1 ctmp < ${_Spacct} |313,314c313,314
< acctcms -a -s sum/daycms | uniq -u | sed -n 1,56p > nite/daycms
< acctcms -a -s sum/cms | uniq -u | sed -n 1,56p > nite/cms
---
> acctcms -a -s sum/daycms | sed -n 1,56p > nite/daycms
> acctcms -a -s sum/cms | sed -n 1,56p > nite/cms
hood 30 %

 

[Guest_imported]

If your pacct grows rapidly it becuase you are spawning/executing processes at a very high rate. sar -c will show you the # of forks and execs. Make sure some script is not in a dead loop, something like this:
while :
do
ls -l something
done

Change any of these to include a sleep:

while :
do
ls -l xxxx
sleep 5 (or whatever)
done