Enable accounting and view system usage statistics

Reviewer: name contact BSD flavour

Reviewer: Brett Mahar brett.maharATgmailDOTcom OpenBSD

Concept

Be aware of when it is appropriate to enable system accounting, recognize which utilities are available to do so, and know how to view the resulting statistics.

Introduction

The kernel keeps track of various attributes of all processes and, when system accounting (((accounting))) (((system accounting))) is enabled, this information is saved when the process terminates. The accounting information includes the command name, the starting time, the amount of time used by the system and the user (TODO: explain that), the elapsed time, the user ID and group ID, the average amount of memory used, the count of I/O operations, and the terminal (((terminal))) (tty) (((tty))) where the process was started. The accounting also records if the process was forked without replacing the parent process (exec) and how the process was terminated (such as with core dump or killed by a signal).

The system accounting is enabled by running the accton command with the path to the file to store the data as the argument, commonly at /var/account/acct.

System accounting is turned off by running accton without any arguments.

When accounting is enabled, the lastcomm command will show recent commands, inreverse chronological order. Arguments can be added to filter this information by user, terminal, or command name (see man page).

For OpenBSD, accton is enabled at boot time by changing the parameter in /etc/rc.conf.local to accounting=YES.

NetBSD uses the same variable, but in the file /etc/rc.conf.

Both DragonflyBSD and FreeBSD use the accounting_enable variable in /etc/rc.conf.

TODO: show example of data; show examples of sa, ac, accton, lastcomm

TODO: not the same, but also cover "last"

Examples

Practice Exercises

More information

ac(8), sa(8), accton(8), lastcomm(1), last(1)