## Enable accounting and view system usage statistics ##

[Author](authors.html): _name_ _[[contact]]_ _[[BSD_flavour]]_

[Reviewer](technical_reviewers.html): _name_ _[[contact]]_ _[[BSD_flavour]]_

[Reviewer](technical_reviewers.html): Brett Mahar brett.maharATgmailDOTcom OpenBSD

----

### Concept ###

Be aware of when it is appropriate to enable
system accounting, recognize which utilities are available to do so,
and know how to view the resulting statistics.

### Introduction ###

The kernel keeps track of various attributes of all processes and, when system accounting (((accounting))) (((system accounting)))
is enabled, this information is saved when the process terminates.
The accounting information includes the command name, the starting time, the amount of time used by the system and the user (TODO: explain that),
the elapsed time, the user ID and group ID, the average amount of memory used, the count of I/O operations,  and the terminal (((terminal))) (tty) (((tty)))
where the process was started. The accounting also records if the process was forked without replacing the parent process (exec) and
how the process was terminated (such as with core dump or killed by a signal).

<!-- Note: some BSDs don't record if used superuser permissions or if used compatibility mode-->

The system accounting is enabled by running the `accton` command with the path to the file to store the data as the argument, commonly at
`/var/account/acct`.

System accounting is turned off by running `accton` without any arguments.

When accounting is enabled, the `lastcomm` command will show recent commands, inreverse chronological order. Arguments can be added to filter this information by user, terminal, or command name (see man page).

For OpenBSD, accton is enabled at boot time by changing the parameter in /etc/rc.conf.local to accounting=YES. 

NetBSD uses the same variable, but in the file /etc/rc.conf.

Both DragonflyBSD and FreeBSD use the accounting_enable variable in /etc/rc.conf.

TODO: show example of data; show examples of sa, ac, accton, lastcomm

TODO: not the same, but also cover "last"

### Examples ###


### Practice Exercises ###


### More information ###

ac(8), sa(8), accton(8), lastcomm(1), last(1)
