The psacct service is responsible for starting and stopping process accounting at system boot time and at system shutdown. This service is a wrapper that invokes the accton accounting control program. A user may need to collect process accounting data to better understand which commands were executed on a system. The file /var/account/psacct is where all process accounting data is logged. The file can not be read directly and we need to use the command “strings” to read the file.

 

Start/Stop/Enable/Disable process accounting (psacct)

 

Install the psacct package:

# yum install psacct

 

This will create the file /var/account/psacct.

 

Start process accounting:

# service psacct start
Starting process accounting:     [  OK  ]

 

# service psacct status
Process accounting is enabled.

 

Stop process accounting:

# service psacct stop
Stopping process accounting:     [  OK  ]

 

# service psacct status
Process accounting is disabled.

 

Enable process accounting so it starts at boot time:

# chkconfig psacct on

 

Disable process accounting so it doesn’t start at boot time:

# chkconfig psacct off

 

If the psacct package is installed but the file /var/account/psacct is missing, it can be created and process accounting started by logging in as as root and running the commands below:

# touch /var/account/pacct
# chown root /var/account/pacct
# chmod 0644 /var/account/pacct 
# accton /var/account/pacct

 

Tools

 

Data can be interpreted using the ac and lastcomm commands. To verify that data is being collected in some capacity, the string command can be helpful.

# strings /var/account/pacct

 

To start process accounting (without booting or using service script):

# accton on

 

To stop process accounting (without booting or using service script):

# accton off

 

Was this answer helpful? 135 Users Found This Useful (170 Votes)