How to Start, Stop and Use Process Accounting (psacct and acct)

Updated: 28 September 2026 · Applies to: psacct 6.6.4 on AlmaLinux and Rocky Linux 9 and 10 and RHEL 9 and 10; acct 6.6.4 on Ubuntu 24.04 and 26.04 and Debian 13

Process accounting records every command that finishes on the server: who ran it, when, and how much CPU time it used. It helps answer "who ran this?" after an incident and shows which users or programs use the most resources. The package is called psacct on the Red Hat family and acct on Ubuntu and Debian; the commands are the same.

Install, start and enable

dnf install psacct && systemctl enable --now psacct     # AlmaLinux, Rocky Linux, RHEL
apt install acct && systemctl enable --now acct         # Ubuntu, Debian

Check that it runs: systemctl status psacct (or acct). Accounting starts from this moment; earlier commands are not recorded.

Stop and disable

systemctl disable --now psacct       # or: acct

Underneath, the service runs accton with the accounting file to switch recording on, and accton off to switch it off.

Read the records

lastcomm                 # recently finished commands, newest first
lastcomm alice           # only commands of user alice
lastcomm rm              # only runs of the rm command
sa -m                    # CPU use summed per user
sa                       # summary per command
ac -d                    # login time per day
ac -p                    # login time per user

lastcomm shows the command name, flags (for example S when it ran with superuser rights, F after a fork without exec), the user, the terminal, the CPU time and the start time. It records command names, not full command lines or arguments.

Disk space

The records are kept in /var/account/pacct (Red Hat family) or /var/log/account/pacct (Ubuntu, Debian) and rotated automatically by the package's logrotate or cron setup. On very busy servers they grow quickly; check the size from time to time.

For full command lines

If you need the complete command with its arguments, use the audit system instead, for example an execve audit rule for selected users; see how to find the commands run by users.

Official documentation: GNU Accounting Utilities manual.