Hey Linuxers!					-*-Text-*-

New info:

Patches for 1.0, 1.1.9, and 1.1.12.  I've been more concerned with
adding the rest of the features to sa than doing the kernel patches,
however, so these are the same as before.  I know what's wrong with
the ac_mem and time statistics, I just need an extra afternoon to
change the stuff and verify my fixes.  I'm also coordinating with
Marco van Wieringen so as to not screw up the quota stuff.

Older info:

Well, I've got this stuff up and running on my own linux box -- it
works just fine.  Unfortunately, Linux doesn't yet support the ac_mem
or ac_io statistics in its STRUCT ACCT, so you won't see that info
coming out in sa (I just threw in a few ifdefs...).

The patches I'm including in this file are based on those by Marco van
Wieringen <mvw@mercury.mcs.nl.mugnet.org>, which, in turn, look like
they're based on those of Juha Virtanen <Juha.Virtanen@hut.fi>, which
are ports of the code of Alan Cox <iiitac@pyr.swan.ac.uk>, who hacked
all of this together in the first place (whew!).  Thanks to everyone
for the great work done so far!

My changes:

* port to Linux v1.0
* added initializers for other object file formats (COFF and ELF)
* added support for the AC_IO field
* made the sys_acct call properly release the file if called
  with a NULL argument (so you don't get a "/dev/hd??: device busy"
  message when umounting your drives for shutdown/reboot)
* removed page fault information AC_MINFLT and AC_MAXFLT, as well as
  AC_EXITCODE (no other acct that I've ever seen has kept this kind of
  information) -- it will save a bunch of disk space in the long run

Right now, I'm working on the AC_MEM field.  I'm debating whether or
not to go with the standard definition (which tries to come up with an
average memory-use per tick) versus one that's easier to understand:
what if AC_MEM was just the size of the process (data + code +
shared)?  Hopefully I'll have something to show in a while.

Also, I'm considering the usefulness of changing the types of AC_MEM
and AC_IO to COMP_T (a strange floating-point number).  Any
suggestions?  More overhead in the kernel, ubdoubtedly.

TO PATCH YOUR KERNEL, cd into the top level source directory and do
something like "patch -p1 < <wherever-this-is>/LINUX-<version>" to apply
the diffs.  Make sure to do a "make dep; make clean; make" because I
added a field to the STRUCT TASK_STRUCT.

IMPORTANT NOTE: if you have the Quota patches, there may be a
rejection in exec.c (see below).  You'll also have to change the
#undef QUOTA_PATCHES at the top of the file...

Just ignore the memory information that you get from sa for now.
After I've figured out what to do about AC_MEM, I'll fix it.  Please
pound on everything else, however.  savacct and useracct support
coming soon!

WEIRDNESS: After you've got the patches installed and these programs
running, try doing a configure in the source directory and then check
out the output of lastcomm.  Does anyone know why shell scripts like
configure seem to keep getting reparented and running under different
PIDs?  We really don't want to record these transients -- just the
last entry that has the total CPU and IO.

----------------------------------------------------------------------
Here's Marco's original README:
----------------------------------------------------------------------

The patches here are for Linux-0.99pl15. Apply them with
"patch -p1 < kernel_diffs" in the /usr/src/linux dir. So

1) cd /usr/src/linux
2) patch -p1 < <where_ever_you_put_it>/kernel_diffs

Check for rejections and do somthing about it.
3) find . -name \*.rej

If you installed the quota-1.3 package you should have gotten one rejection
file, fs/exec.c.rej this is because its already in the quota-1.3 package.

IMPORTANT: If you don't install the quota-1.3 package make sure you edit
kernel/sys.c and comment out the vfs_open_filp call and the include of
fileio.h.

Now do a make and that should make a new kernel. When you finished make the
utils. Now all should be running. Add something like 
"/usr/sbin/accton /var/adm/acct" to your rc startup script. And somthing
like "/usr/sbin/accton" to the rc-script that shuts your system down.

Have fun.

Marco.

M. van Wieringen <v892273@si.hhs.nl> <mvw@mercury.mcs.nl.mugnet.org>

----------------------------------------------------------------------
Here's Juha's original README file:
----------------------------------------------------------------------
AcctKit 0.99.12

This kit of pieces adds process accounting to the standard Linux
kernel. It contains a diff file relative to the 0.99.12, a new include
file and ports of the BSD NET2 accton and lastcomm commands.

***Important: The lastcomm and accton programs from this kit are part
of the BSD NET2 release. See lastcomm.c and accton.c for the UCB
licensing conditions


To install:

Unpack the source with

gzip -d acctkit-0.99.12.tar.gz | tar -xzvvf -

Note that the linux source is assumed to lie in /usr/src/linux
subdirectory tree. After patching copy .../acctkit-0.99.11/acct.h
to your /usr/src/linux/include/linux directory.

cd /usr/src
patch < acctkit-0.99.12/diffs-0.99.12
cp acctkit-0.99.12/acct.h /usr/src/linux/include/linux/acct.h
cd acctkit-0.99.12
mv accton /etc/accton
mv lastcomm /usr/bin/lastcomm
cp lastcomm.1 /usr/man/man1/lastcomm.1
touch /usr/adm/acct

Build a new kernel.

With this new kernel you can enable accounting with command
'/etc/accton /usr/adm/acct'. Disable it with '/etc/accton', and look
at command histories with 'lastcomm [user]'.

If you upgraded from older kernel than 0.99.11 and already had
accounting running, zap the old accounting file to 0 size before
starting accounting with new kernel. For example, say:

/etc/accton
cp /dev/null /usr/adm/acct

and then reboot. After that everything should be okay again.


Limitations
-----------

I don't implement memory, pagefault or disk usage logging, just
commands and whether it ran as root. Its enough for my purposes with
our computer society system.

LICENSE
--------
All original code in this kit is placed under the GNU public license.
All other material carries its own copyright messages which you should
check to ensure they are suitable.


THANKS and miscellaneus notes
------------------------------
I found this package originally as acctkit-0.99.8.tar.Z from
nic.funet.fi.  Alan Cox <iiitac@pyr.swan.ac.uk> had done most of the
work this far; Thanks a lot to him.

I just cleaned up the code a little, set up a makefile and made new
diffs against stock linux 0.99.12 kernel release.

New in 0.99.11
---------------
Accounting now supports full length filenames. This leads into
incompatibility with older version and you must get rid of old
accounting information before starting accounting.  I did also some
cleanup and added c++ support (even I don't know any c++ ;-) among
other things.

New in 0.99.12
---------------
New diffs...


Juha Virtanen, email <Juha.Virtanen@hut.fi>

