Updated: 28 September 2026 · Applies to: psacct 6.6.4 on AlmaLinux and Rocky Linux 9 and 10 and RHEL 9 and 10; acct 6.6.4 on Ubuntu 24.04 and 26.04 and Debian 13
Process accounting records every command that finishes on the server: who ran it, when, and how much CPU time it used. It helps answer "who ran this?" after an incident and shows which users or programs use the most resources. The package is called psacct on the Red Hat family and acct on Ubuntu and Debian; the commands are the same.
Install, start and enable
dnf install psacct && systemctl enable --now psacct # AlmaLinux, Rocky Linux, RHEL apt install acct && systemctl enable --now acct # Ubuntu, Debian
Check that it runs: systemctl status psacct (or acct). Accounting starts from this moment; earlier commands are not recorded.
Stop and disable
systemctl disable --now psacct # or: acct
Underneath, the service runs accton with the accounting file to switch recording on, and accton off to switch it off.
Read the records
lastcomm # recently finished commands, newest first lastcomm alice # only commands of user alice lastcomm rm # only runs of the rm command sa -m # CPU use summed per user sa # summary per command ac -d # login time per day ac -p # login time per user
lastcomm shows the command name, flags (for example S when it ran with superuser rights, F after a fork without exec), the user, the terminal, the CPU time and the start time. It records command names, not full command lines or arguments.
Disk space
The records are kept in /var/account/pacct (Red Hat family) or /var/log/account/pacct (Ubuntu, Debian) and rotated automatically by the package's logrotate or cron setup. On very busy servers they grow quickly; check the size from time to time.
For full command lines
If you need the complete command with its arguments, use the audit system instead, for example an execve audit rule for selected users; see how to find the commands run by users.
Official documentation: GNU Accounting Utilities manual.
