The psacct service is responsible for starting and stopping process accounting at system boot time and at system shutdown. This service is a wrapper that invokes the accton accounting control program. A user may need to collect process accounting data to better understand which commands were executed on a system. The file /var/account/psacct is where all process accounting data is logged. The file can not be read directly and we need to use the command “strings” to read the file.
Start/Stop/Enable/Disable process accounting (psacct)
Install the psacct package:
# yum install psacct
This will create the file /var/account/psacct.
Start process accounting:
# service psacct start Starting process accounting: [ OK ]
# service psacct status Process accounting is enabled.
Stop process accounting:
# service psacct stop Stopping process accounting: [ OK ]
# service psacct status Process accounting is disabled.
Enable process accounting so it starts at boot time:
# chkconfig psacct on
Disable process accounting so it doesn’t start at boot time:
# chkconfig psacct off
If the psacct package is installed but the file /var/account/psacct is missing, it can be created and process accounting started by logging in as as root and running the commands below:
# touch /var/account/pacct # chown root /var/account/pacct # chmod 0644 /var/account/pacct # accton /var/account/pacct
Tools
Data can be interpreted using the ac and lastcomm commands. To verify that data is being collected in some capacity, the string command can be helpful.
# strings /var/account/pacct
To start process accounting (without booting or using service script):
# accton on
To stop process accounting (without booting or using service script):
# accton off
