[Savannah-users] ac bug? ac -f /var/log/wtmp.1 resulting in ac: Possible

Hello guys,

We got an alert like the below:

{{{

Cron <address@hidden> test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )

/etc/cron.monthly/acct:

ac: Possible overflow of time_t! Can't continue.

}}}

The issue is replicable:

{{{

$ sudo /etc/cron.monthly/acct

ac: Possible overflow of time_t! Can't continue.

}}}

Further debugging showed:

{{{

$ ac -f /var/log/wtmp.1

/var/log/wtmp.1:10: problem: update user sampleadmin (for shutdown) with -46 seconds?!

ac: Possible overflow of time_t! Can't continue.

}}}

If we parse wtmpt.1 with http://www.hcidata.info/wtmp.htm perl script and dump-utmp we get different date time:

{{{

$ perl -we '@type=("Empty","Run Lvl","Boot","New Time","Old Time","Init","Login","Normal","Term","Account");$recs = ""; while (<>) {$recs .= $_};foreach (split(/(.{384})/s,$recs)) {next if length($_) == 0;my ($type,$pid,$line,$inittab,$user,$host,$t1,$t2,$t3,$t4,$t5) = $_ =~/(.{4})(.{4})(.{32})(.{4})(.{32})(.{256})(.{4})(.{4})(.{4})(.{4})(.{4})/s;if (defined $line && $line =~ /\w/) {$line =~ s/\x00+//g;$host =~ s/\x00+//g;$user =~ s/\x00+//g;printf("%s %-8s %-12s %10s %-45s \n",scalar(gmtime(unpack("I4",$t3))),$type[unpack("I4",$type)],$user,$line,$host)}}print"\n"' < /var/log/wtmp.1

Mon Feb 3 20:01:55 2014 Login LOGIN tty4

Mon Feb 3 20:01:55 2014 Login LOGIN tty5

Mon Feb 3 20:01:55 2014 Login LOGIN tty2

Mon Feb 3 20:01:55 2014 Login LOGIN tty3

Mon Feb 3 20:01:55 2014 Login LOGIN tty6

Mon Feb 3 20:01:55 2014 Login LOGIN tty1

Mon Feb 3 20:02:05 2014 Normal sampleadmin tty1

Mon Feb 3 20:01:19 2014 Term tty4

Mon Feb 3 20:01:19 2014 Term tty5

Mon Feb 3 20:01:19 2014 Term tty2

Mon Feb 3 20:01:19 2014 Term tty3

Mon Feb 3 20:01:19 2014 Term tty6

Mon Feb 3 20:01:37 2014 Login LOGIN tty4

Mon Feb 3 20:01:37 2014 Login LOGIN tty5

Mon Feb 3 20:01:37 2014 Login LOGIN tty2

Mon Feb 3 20:01:37 2014 Login LOGIN tty3

Mon Feb 3 20:01:37 2014 Login LOGIN tty6

Mon Feb 3 20:01:37 2014 Login LOGIN tty1

Mon Feb 3 20:31:05 2014 Normal sampleadmin pts/0 box4.sample.com

Mon Feb 3 20:45:12 2014 Term tty4

Mon Feb 3 20:45:12 2014 Term tty5

Mon Feb 3 20:45:12 2014 Term tty2

Mon Feb 3 20:45:12 2014 Term tty3

Mon Feb 3 20:45:12 2014 Term tty6

Mon Feb 3 20:45:12 2014 Term tty1

Mon Feb 3 20:45:13 2014 Term pts/0

Mon Feb 3 20:45:28 2014 Login LOGIN tty4

Mon Feb 3 20:45:28 2014 Login LOGIN tty5

Mon Feb 3 20:45:28 2014 Login LOGIN tty2

Mon Feb 3 20:45:28 2014 Login LOGIN tty3

Mon Feb 3 20:45:28 2014 Login LOGIN tty6

Mon Feb 3 20:45:28 2014 Login LOGIN tty1

Mon Feb 3 22:15:29 2014 Normal sampleadmin pts/0 box4.sample.com

Mon Feb 3 22:31:56 2014 Term pts/0

Mon Feb 3 22:33:40 2014 Normal sampleadmin pts/0 box4.sample.com

Mon Feb 3 22:33:40 2014 Term pts/0

Mon Feb 3 22:33:41 2014 Normal sampleadmin pts/0 box4.sample.com

Mon Feb 3 22:41:27 2014 Term pts/0

Tue Feb 4 02:09:24 2014 Normal sampleadmin pts/0 box4.sample.com

Tue Feb 4 02:10:18 2014 Normal sampleadmin pts/1 box4.sample.com

Tue Feb 4 02:10:18 2014 Term pts/1

Tue Feb 4 02:10:18 2014 Normal sampleadmin pts/1 box4.sample.com

Tue Feb 4 02:12:57 2014 Term pts/1

Tue Feb 4 02:14:38 2014 Normal sampleadmin pts/1 box4.sample.com

Tue Feb 4 02:28:41 2014 Term pts/0

Tue Feb 4 02:28:45 2014 Term pts/1

Wed Feb 5 23:55:03 2014 Normal sampleadmin pts/0 box4.sample.com

Thu Feb 6 00:10:19 2014 Term pts/0

Thu Feb 6 13:30:10 2014 Normal sampleadmin pts/0 box4.sample.com

Thu Feb 6 13:30:10 2014 Term pts/0

Thu Feb 6 13:30:10 2014 Normal sampleadmin pts/0 box4.sample.com

Thu Feb 6 13:33:11 2014 Term pts/0

Thu Feb 6 13:36:23 2014 Normal sampleadmin pts/0 box4.sample.com

Thu Feb 6 13:58:14 2014 Term pts/0

Sat Feb 8 18:52:03 2014 Normal sampleadmin pts/0 192.168.5.101

Sat Feb 8 23:05:52 2014 Term pts/0

Sun Feb 9 17:56:39 2014 Normal sampleadmin pts/0 192.168.0.223

Sun Feb 9 17:56:50 2014 Term pts/0

$ /usr/sbin/dump-utmp /var/log/wtmp.1

reboot |~ |2|~~ | 0|3.11.0-12-generic |Mon Feb 3 15:01:55 2014

runlevel |~ |1|~~ | 50|3.11.0-12-generic |Mon Feb 3 15:01:55 2014

sampleadmin |tty1 |7| | 854| |Mon Feb 3 15:02:05 2014

runlevel |~ |1|~~ |12854|3.11.0-12-generic |Mon Feb 3 15:01:19 2014

|tty4 |8|4 | 747| |Mon Feb 3 15:01:19 2014

|tty5 |8|5 | 754| |Mon Feb 3 15:01:19 2014

|tty2 |8|2 | 768| |Mon Feb 3 15:01:19 2014

|tty3 |8|3 | 769| |Mon Feb 3 15:01:19 2014

|tty6 |8|6 | 772| |Mon Feb 3 15:01:19 2014

shutdown |~ |1|~~ | 0|3.11.0-12-generic |Mon Feb 3 15:01:19 2014

reboot |~ |2|~~ | 0|3.11.0-12-generic |Mon Feb 3 15:01:37 2014

runlevel |~ |1|~~ | 50|3.11.0-12-generic |Mon Feb 3 15:01:37 2014

sampleadmin |pts/0 |7|ts/0| 1168|box4.sample.com |Mon Feb 3 15:31:05 2014

runlevel |~ |1|~~ |12854|3.11.0-12-generic |Mon Feb 3 15:45:12 2014

|tty4 |8|4 | 784| |Mon Feb 3 15:45:12 2014

|tty5 |8|5 | 799| |Mon Feb 3 15:45:12 2014

|tty2 |8|2 | 806| |Mon Feb 3 15:45:12 2014

|tty3 |8|3 | 808| |Mon Feb 3 15:45:12 2014

|tty6 |8|6 | 821| |Mon Feb 3 15:45:12 2014

|tty1 |8|1 | 893| |Mon Feb 3 15:45:12 2014

|pts/0 |8| | 1168| |Mon Feb 3 15:45:13 2014

shutdown |~ |1|~~ | 0|3.11.0-12-generic |Mon Feb 3 15:45:13 2014

reboot |~ |2|~~ | 0|3.11.0-12-generic |Mon Feb 3 15:45:28 2014

runlevel |~ |1|~~ | 50|3.11.0-12-generic |Mon Feb 3 15:45:28 2014

sampleadmin |pts/0 |7|ts/0| 1199|box4.sample.com |Mon Feb 3 17:15:29 2014

|pts/0 |8| | 1199| |Mon Feb 3 17:31:56 2014

sampleadmin |pts/0 |7|ts/0| 1347|box4.sample.com |Mon Feb 3 17:33:40 2014

|pts/0 |8| | 1347| |Mon Feb 3 17:33:40 2014

sampleadmin |pts/0 |7|ts/0| 1448|box4.sample.com |Mon Feb 3 17:33:41 2014

|pts/0 |8| | 1448| |Mon Feb 3 17:41:27 2014

sampleadmin |pts/0 |7|ts/0|25523|box4.sample.com |Mon Feb 3 21:09:24 2014

sampleadmin |pts/1 |7|ts/1|25662|box4.sample.com |Mon Feb 3 21:10:18 2014

|pts/1 |8| |25662| |Mon Feb 3 21:10:18 2014

sampleadmin |pts/1 |7|ts/1|25675|box4.sample.com |Mon Feb 3 21:10:18 2014

|pts/1 |8| |25675| |Mon Feb 3 21:12:57 2014

sampleadmin |pts/1 |7|ts/1| 1471|box4.sample.com |Mon Feb 3 21:14:38 2014

|pts/0 |8| |25523| |Mon Feb 3 21:28:41 2014

|pts/1 |8| | 1471| |Mon Feb 3 21:28:45 2014

sampleadmin |pts/0 |7|ts/0| 3111|box4.sample.com |Wed Feb 5 18:55:03 2014

|pts/0 |8| | 3111| |Wed Feb 5 19:10:19 2014

sampleadmin |pts/0 |7|ts/0| 3705|box4.sample.com |Thu Feb 6 08:30:10 2014

|pts/0 |8| | 3705| |Thu Feb 6 08:30:10 2014

sampleadmin |pts/0 |7|ts/0| 3718|box4.sample.com |Thu Feb 6 08:30:10 2014

|pts/0 |8| | 3718| |Thu Feb 6 08:33:11 2014

sampleadmin |pts/0 |7|ts/0|11992|box4.sample.com |Thu Feb 6 08:36:23 2014

|pts/0 |8| |11992| |Thu Feb 6 08:58:14 2014

sampleadmin |pts/0 |7|ts/0|14090|192.168.5.101 |Sat Feb 8 13:52:03 2014

|pts/0 |8| |14090| |Sat Feb 8 18:05:52 2014

sampleadmin |pts/0 |7|ts/0|14870|192.168.0.223 |Sun Feb 9 12:56:39 2014

|pts/0 |8| |14870| |Sun Feb 9 12:56:50 2014

}}}

Will this be a candidate to fill an "ac" bug?

Thanks in advanced,

- Nestor

From:	Nestor Urquiza
Subject:	[Savannah-users] ac bug? ac -f /var/log/wtmp.1 resulting in ac: Possible overflow of time_t! Can't continue.
Date:	Sat, 1 Mar 2014 10:19:44 -0500