Bug 248965 - lastcomm doesn't display flags
Summary: lastcomm doesn't display flags
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: psacct
Version: 4.5
Hardware: All
OS: Linux
low
low
Target Milestone: ---
: ---
Assignee: Ivana Varekova
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2007-07-19 21:31 UTC by Buck Huppmann
Modified: 2010-05-12 08:20 UTC (History)
0 users

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-05-12 08:20:54 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Description Buck Huppmann 2007-07-19 21:31:01 UTC
Description of problem:

lastcomm doesn't show flags

Version-Release number of selected component (if applicable):

6.3.2-39.rhel4

How reproducible:

run lastcomm

Steps to Reproduce:
1. lastcomm
2.
3.
  
Actual results:

no flags

Expected results:

flags

Additional info:

here's some demo output for a forking process, first from a RH3 machine:

% rpm -q redhat-release ; rpm -q psacct ; lastcomm -f pacct
redhat-release-3WS-13.8.3
psacct-6.3.2-35.rhel3
logrotate          F    root     __         0.00 secs Thu Jul 19 04:02
%

then from an RH4 machine

% ssh rh4machine 'rpm -q redhat-release; rpm -q psacct; set temp=`mktemp` &&
(cat > "$temp" && lastcomm -f "$temp"; rm "$temp")' < pacct
redhat-release-4WS-6.1
psacct-6.3.2-39.rhel4
logrotate               root     __         0.00 secs Thu Jul 19 04:02
% 

besides the ``F'' flag, i haven't seen any ``S'' flags either

Comment 1 Buck Huppmann 2007-07-20 11:25:28 UTC
the problem is with

psacct-6.3.2-large-uid.patch

. it replaces include-ing the system <linux/acct.h>, which contains

% grep '#define *A.*0x' /usr/include/linux/acct.h 
#define AFORK           0x01    /* ... executed fork, but did not exec */
#define ASU             0x02    /* ... used super-user privileges */
#define ACOMPAT         0x04    /* ... used compatibility mode (VAX only not
used) */
#define ACORE           0x08    /* ... dumped core */
#define AXSIG           0x10    /* ... was killed by a signal */

with its own acct.h, which defines the flag constants as enums instead of
preprocessor macros:

% sed -n '/enum/,/^[-+]*$/p' ../SOURCES/psacct-6.3.2-large-uid.patch
+enum
+  {
+    AFORK = 0x01,              /* Has executed fork, but no exec.  */
+    ASU = 0x02,                        /* Used super-user privileges.  */
+    ACORE = 0x08,              /* Dumped core.  */
+    AXSIG = 0x10               /* Killed by a signal.  */
+  };
+

thus, when the below compiles

% sed -n '/AFORK/,/endif/p' acct-6.3.2/lastcomm.c
#ifdef AFORK
          if (rec->ac_flag & AFORK)
            putchar ('F');
          else
#endif

there's no defined C preprocessor AFORK macro, so the code isn't compiled in

Comment 2 Ivana Varekova 2007-07-25 12:47:04 UTC
Thanks for your bug report, the accounting flags should be defined as macros
here, you are right.

Comment 3 Ivana Varekova 2010-05-12 08:20:54 UTC
Only important issues like performance and security are fixed in RHEL 4.9 and
later. This bug does not meet necessary criteria and is therefore closed. The bug does not affect RHEL 5.


Note You need to log in before you can comment on or make changes to this bug.