Description of problem: calling lasscomm gives a list with commands executed only by root, even those called from someone else. Version-Release number of selected component (if applicable): psacct-6.3.2-55.fc12.i686 How reproducible: lastcomm | grep -v root is allways empty Additional info: - It seems to me that the uid field in /var/account/pacct file is allways zero. - It all works fine with fedora 11
When I try to reproduce this problem I found a bug in psacct init script. So please could you test whether your psacct daemon is running? If yes then just try to call any command (ls, dome other) by non-root user and test whether the problem happen and write here the result. (If the problem will appear again, plese write here whether the command is not on the list or is on the list and the user is root there). Thanks.
psacct-6.3.2-59.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/psacct-6.3.2-59.fc12
I assume, that the update only fixes the init script and it has not yet arrived here, so my answer to comment #1: - psacct is running ("/etc/init.d/psacct status" says so - but there should not be a daemon running?) - commands are logged and shown by lastcomm - commands from no-root-user are listed but as being executed by root
Yes you are right - the update fix only the init script - but there is some changes of input file handling too (the previous patches). So it is worth to test too. Please could you run some test case and attach here the relevant /var/account/psacct file (or its part) and write here which command from psacct output (some unified description like command name and time if it is not uniq then some other detail) should belong to non-root user there (id would be useful to have the user id of user which run the application too). Thanks.
as root: # touch /var/account/test # accton /var/account/test as user gasi uid=1377: $ ls | grep a | sort back to root: # accton /var/account/pacct # lastcomm -f /var/account/test accton root pts/0 0.00 secs Wed Dec 9 10:09 ksmtuned F root __ 0.00 secs Wed Dec 9 10:09 awk root __ 0.00 secs Wed Dec 9 10:09 ps S root __ 0.01 secs Wed Dec 9 10:09 ksmtuned F root __ 0.00 secs Wed Dec 9 10:09 pgrep root __ 0.00 secs Wed Dec 9 10:09 ksmtuned F root __ 0.00 secs Wed Dec 9 10:09 awk root __ 0.00 secs Wed Dec 9 10:09 sleep root __ 0.00 secs Wed Dec 9 10:08 grep root pts/5 0.00 secs Wed Dec 9 10:09 sort root pts/5 0.00 secs Wed Dec 9 10:09 ls root pts/5 0.00 secs Wed Dec 9 10:09 accton S root pts/0 0.00 secs Wed Dec 9 10:09 - the user(gasi) entries have been called on pts/5 - I try to attach the binary file /var/account/test to this bug-report
Created attachment 377124 [details] psacct/accton binary output /var/account/test
Hello, for me it looks like kernel problem - the accounting is done by kernel syscall, and lastcomm command seems to work ok and read the data from accounting file fine. Please, to confirm this theory, could you try to downgrade psacct package to the version which works for you (fc11 version - rpms are eg. on http://koji.fedoraproject.org/koji/buildinfo?buildID=91298 ). And then try to reproduce the problem again and write here the results?
Your shurely are right: the kernel writes /var/account/psacct and there is no other uid but 0 inside. Anyway -I tried it with psacct-6.3.2-53.fc11.i586 and have the same faulty results
Thanks for the testing, I'm reassigning the bug to kernel.
Already reported upstream: http://bugzilla.kernel.org/show_bug.cgi?id=14676 A patch from Alexey Dobriyan fixes it and should be merged in Linus's tree soon. http://lkml.org/lkml/2009/11/30/425 The patch has been proposed into 2.6.31-stable also.
*** This bug has been marked as a duplicate of bug 543456 ***
psacct-6.3.2-59.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.