Intro: Understanding Process Accounting in Linux/Unix Systems
In multi-user Unix and Linux environments, keeping track of what’s happening under the hood is essential—for security, system performance, compliance, and resource management. One powerful but often overlooked feature that provides deep visibility into system activity is process accounting.
Process accounting records every command executed on a system, along with key details such as the user who ran it, the time it was executed, how long it ran, how much CPU and memory it consumed, and more. This information is stored in binary log files such as /var/account/pacct or /var/account/acct, which can then be analyzed using specialized tools.
System administrators, security analysts, and auditors use this data for a wide range of purposes: tracking user activity, analyzing system resource usage, investigating security incidents, or even supporting cost allocation in shared computing environments. In regulated industries, process accounting can also serve as a reliable audit trail, helping organizations meet compliance requirements.
While it doesn’t capture full command-line arguments or real-time process behavior, process accounting provides a concise, system-wide history of what has been run and by whom—making it a valuable component of any robust monitoring or auditing strategy.
In this article, we'll explore what process accounting is, how it works, what kind of data it records, and how it can be used to improve system transparency, security, and efficiency.
Understanding the /var/account/pacct or /var/account/acct files involves diving into process accounting on Unix and Linux systems. These files log detailed information about every process that has run on the system. They are binary files and not human-readable so to parse them you the sa / lastcomm tools.
What are /var/account/pacct and /var/account/acct dirs and common locations across *nix OS-es?
- These are process accounting files used to log per-process execution details.
- Created and maintained by the acct package (acctd or psacct, depending on your distro).
- Location may vary slightly by distro:
- /var/account/pacct – common on Debian/Ubuntu as well as on FreeBSD / OpenBSD
- /var/account/acct – common on Red Hat/CentOS.
- /var/adm/pact – is location for Sun Solaris UNIX (if you face some legacy systems somewhere and you wonder what it is)
What Do process account data dirs contain ?
These binary log files record information like:
| Field | Description |
|---|---|
| ac_comm | Command name (truncated to 16 characters) |
| ac_utime | User CPU time used |
| ac_stime | System CPU time used |
| ac_etime | Elapsed time |
| ac_btime | Process start time (in epoch seconds) |
| ac_uid | User ID of the process owner |
| ac_gid | Group ID of the process |
| ac_mem | Average memory usage (in pages) |
| ac_io | I/O operations (usually blocks read/written) |
| ac_tty | Controlling terminal |
| ac_exitcode | Exit status |
| ac_flag | Flags (forked, exec'd, etc.) |
Note: The exact fields and formats may vary based on your OS and kernel version.
How to View or Parse the acct File
Since the file is binary, use tools to interpret it:
1. lastcomm command – Shows last executed commands
# lastcomm
- Output includes user, command, CPU time, and date/time.
Note ! that if lastcomm returns an empty output that means the process accounting (if installed on the system) is not yet enabled. To have it return its purposed data enable it.
2. accton – Enables or disables accounting
To enable proc accounting:
# accton on /var/account/pact
To disable proc accounting:
# accton off /var/account/pact
3. Enable disable process accounting on Linux boot
On Redhat based Linux distributions accton can be switch on / off on boot up with the good old chkconfig command
On Debian based Ubuntu / Mint etc. distros
To enable process accounging service on boot:
# update-rc.d acct defaults
# /etc/init.d/acct start
Alternatively you can do it on Debian Linux via its config /etc/default/acct:
# cat /etc/default/acct
# Defaults for acct
# If you want to keep acct installed, but not started automatically, set this
# variable to 0. Because /etc/cron.daily/acct calls the initscript daily, it is
# not sufficient to stop acct once after booting if your machine remains up.
ACCT_ENABLE="1"
# Amount of days that the logs are kept.
ACCT_LOGGING="30"
On Redhat RPM distros good old chkconfig is used
# chkconfig psacct on
4. sa command (summary accounting)
# sa
- 3414 54989.71re 64.59cp 0avio 16834k
- 34 54603.57re 61.21cp 0avio 38640k ***other*
- 14 1.33re 1.29cp 0avio 74725k ls
- 39 11.88re 1.16cp 0avio 56746k find
- 149 25.51re 0.83cp 0avio 64912k spamd
- 16 293.95re 0.06cp 0avio 0k kworker/dying*
- 22 5.12re 0.01cp 0avio 3951k sshd
- 3 0.01re 0.01cp 0avio 61611k awstats.pl
- 2 11.93re 0.00cp 0avio 58288k ssh
- 3 0.00re 0.00cp 0avio 76224k php5.6
- 2 0.00re 0.00cp 0avio 75824k php7.3
- 7 0.65re 0.00cp 0avio 56846k bash
- 2 0.00re 0.00cp 0avio 75360k php7.0
- 2 0.00re 0.00cp 0avio 69920k php8.3
- 4 0.00re 0.00cp 0avio 58032k mkvalidrcptto
- 2 0.00re 0.00cp 0avio 75408k php7.4
- 2 0.00re 0.00cp 0avio 69920k php8.2
- 60 2.02re 0.00cp 0avio 56882k cron*
- 3 1.24re 0.00cp 0avio 56144k less
- 2 0.00re 0.00cp 0avio 57272k dpkg
- 5 0.01re 0.00cp 0avio 23664k dig
- 3 0.00re 0.00cp 0avio 1443k lastcomm
- 2 0.31re 0.00cp 0avio 940k dump-acct
- 2 0.00re 0.00cp 0avio 13702k php8.0
- 2 0.02re 0.00cp 0avio 1339k sa
- 1226 1.27re 0.00cp 0avio 631k watchdog*
- 560 0.00re 0.00cp 0avio 5316k zabbix_agentd*
- 153 0.00re 0.00cp 0avio 56612k bash*
- 149 0.12re 0.00cp 0avio 56016k pwd
- 139 2.04re 0.00cp 0avio 644k sh
- 128 0.04re 0.00cp 0avio 644k sessionclean*
- 115 0.00re 0.00cp 0avio 644k which
- 71 0.00re 0.00cp 0avio 56278k sed
- 56 0.00re 0.00cp 0avio 56528k chown
- 39 0.19re 0.00cp 0avio 618k qmail-queue
- 39 0.00re 0.00cp 0avio 705k vdelivermail
- 39 0.00re 0.00cp 0avio 590k qmail-local
- 29 0.53re 0.00cp 0avio 56144k wc
- 28 0.24re 0.00cp 0avio 56032k who
- 28 0.00re 0.00cp 0avio 701k valias
- 28 0.00re 0.00cp 0avio 702k vuserinfo
- 24 17.13re 0.00cp 0avio 2282k qmail-smtpd
- 21 5.04re 0.00cp 0avio 3924k sshd*
- 17 1.16re 0.00cp 0avio 56544k ping
- 12 0.00re 0.00cp 0avio 56032k date
- 10 0.00re 0.00cp 0avio 56512k whoamiSummarizes command usage statistics.
For example to pick up percentage information based on process accounting regarding which process took over most of server’s CPU time
# sa -c
3414 100.00% 54989.71re 100.00% 64.59cp 100.00% 0avio 16834k
34 1.00% 54603.57re 99.30% 61.21cp 94.77% 0avio 38640k ***other*
14 0.41% 1.33re 0.00% 1.29cp 1.99% 0avio 74725k ls
39 1.14% 11.88re 0.02% 1.16cp 1.80% 0avio 56746k find
149 4.36% 25.51re 0.05% 0.83cp 1.28% 0avio 64912k spamd
16 0.47% 293.95re 0.53% 0.06cp 0.09% 0avio 0k kworker/dying*
22 0.64% 5.12re 0.01% 0.01cp 0.02% 0avio 3951k sshd
3 0.09% 0.01re 0.00% 0.01cp 0.02% 0avio 61611k awstats.pl
2 0.06% 11.93re 0.02% 0.00cp 0.01% 0avio 58288k ssh
3 0.09% 0.00re 0.00% 0.00cp 0.00% 0avio 76224k php5.6
2 0.06% 0.00re 0.00% 0.00cp 0.00% 0avio 75824k php7.3
7 0.21% 0.65re 0.00% 0.00cp 0.00% 0avio 56846k bash
2 0.06% 0.00re 0.00% 0.00cp 0.00% 0avio 75360k php7.0
2 0.06% 0.00re 0.00% 0.00cp 0.00% 0avio 69920k php8.3
4 0.12% 0.00re 0.00% 0.00cp 0.00% 0avio 58032k mkvalidrcptto
2 0.06% 0.00re 0.00% 0.00cp 0.00% 0avio 75408k php7.4
2 0.06% 0.00re 0.00% 0.00cp 0.00% 0avio 69920k php8.2
60 1.76% 2.02re 0.00% 0.00cp 0.00% 0avio 56882k cron*
3 0.09% 1.24re 0.00% 0.00cp 0.00% 0avio 56144k less
2 0.06% 0.00re 0.00% 0.00cp 0.00% 0avio 57272k dpkg
5 0.15% 0.01re 0.00% 0.00cp 0.00% 0avio 23664k dig
3 0.09% 0.00re 0.00% 0.00cp 0.00% 0avio 1443k lastcomm
2 0.06% 0.31re 0.00% 0.00cp 0.00% 0avio 940k dump-acct
2 0.06% 0.00re 0.00% 0.00cp 0.00% 0avio 13702k php8.0
2 0.06% 0.02re 0.00% 0.00cp 0.00% 0avio 1339k sa
1226 35.91% 1.27re 0.00% 0.00cp 0.00% 0avio 631k watchdog*
560 16.40% 0.00re 0.00% 0.00cp 0.00% 0avio 5316k zabbix_agentd*
153 4.48% 0.00re 0.00% 0.00cp 0.00% 0avio 56612k bash*
5. dump-acct (from GNU acct) – Parses the binary files stored on machine
# dump-acct /var/account/pacct
- Outputs detailed info per process in a readable format.
6. Installing the process accounting Tools if not already on the system
On Debian/Ubuntu to install:
# apt install acct
On Red Hat/CentOS to install:
# yum install psacct
File Format Details (Technical details)
The pacct file format is defined in C struct form in kernel headers:
struct acct {
char ac_flag;
char ac_version;
uint16_t ac_tty;
uint32_t ac_exitcode;
uint32_t ac_uid;
uint32_t ac_gid;
uint32_t ac_pid;
uint32_t ac_ppid;
uint32_t ac_btime;
uint32_t ac_etime;
uint32_t ac_utime;
uint32_t ac_stime;
uint32_t ac_mem;
uint32_t ac_io;
char ac_comm[16];
};
(Fields may be compressed using "comp_t" – a 16-bit pseudo-floating point format used to save space.)
7. How to Decode comp_t (Optional)
Fields like ac_utime, ac_stime, ac_etime, ac_mem, and ac_io are often stored in comp_t format:
#define MANTSIZE 13
#define EXPSIZE 3
unsigned int expand(comp_t c) {
return ((c & 0x1FFF) << ((c >> 13) & 0x7));
}
So a comp_t value can be interpreted as:
value = mantissa << (exponent)
8. File Growth and Rotation manage
- These files grow over time and can become large.
- Best practice is to rotate and archive them regularly using logrotate or cron jobs.
- Example rotation script (manual):
# mv /var/account/pacct /var/account/pacct.1
# touch /var/account/pacct
# accton /var/account/pacct
Summary what learned
We have learned on what is Process accounting on Linux. The purpose of process accounting is to keep an Audit of what has happened on the Linux server recently thus it is a must to be present on Linux machines, that needs to keep a good history record for potential Security audits like PCI-DSS etc. Here is a short table to recall once again what learned.
| Topic | Summary |
|---|---|
| What it is | Binary log of all executed processes |
| Location | /var/account/pacct or /var/account/acct |
| Tools to read | lastcomm, sa, dump-acct |
| Format | Binary; contains CPU, memory, I/O, UID info |
| Use case | Auditing, usage tracking, forensics |
