☩ Walking in Light with Christ – Faith, Computing, Diary

Intro: Understanding Process Accounting in Linux/Unix Systems

In multi-user Unix and Linux environments, keeping track of what’s happening under the hood is essential—for security, system performance, compliance, and resource management. One powerful but often overlooked feature that provides deep visibility into system activity is process accounting.

Process accounting records every command executed on a system, along with key details such as the user who ran it, the time it was executed, how long it ran, how much CPU and memory it consumed, and more. This information is stored in binary log files such as /var/account/pacct or /var/account/acct, which can then be analyzed using specialized tools.

System administrators, security analysts, and auditors use this data for a wide range of purposes: tracking user activity, analyzing system resource usage, investigating security incidents, or even supporting cost allocation in shared computing environments. In regulated industries, process accounting can also serve as a reliable audit trail, helping organizations meet compliance requirements.

While it doesn’t capture full command-line arguments or real-time process behavior, process accounting provides a concise, system-wide history of what has been run and by whom—making it a valuable component of any robust monitoring or auditing strategy.

In this article, we'll explore what process accounting is, how it works, what kind of data it records, and how it can be used to improve system transparency, security, and efficiency.

Understanding the /var/account/pacct or /var/account/acct files involves diving into process accounting on Unix and Linux systems. These files log detailed information about every process that has run on the system. They are binary files and not human-readable so to parse them you the sa / lastcomm tools.

What are /var/account/pacct and /var/account/acct dirs and common locations across *nix OS-es?

• These are process accounting files used to log per-process execution details.
• Created and maintained by the acct package (acctd or psacct, depending on your distro).
• Location may vary slightly by distro:
  • /var/account/pacct – common on Debian/Ubuntu as well as on FreeBSD / OpenBSD
  • /var/account/acct – common on Red Hat/CentOS.
  • /var/adm/pact – is location for Sun Solaris UNIX (if you face some legacy systems somewhere and you wonder what it is)

What Do process account data dirs contain ?

These binary log files record information like:

Note: The exact fields and formats may vary based on your OS and kernel version.

How to View or Parse the acct File

Since the file is binary, use tools to interpret it:

1. lastcomm command – Shows last executed commands

# lastcomm

• Output includes user, command, CPU time, and date/time.

Note ! that if lastcomm returns an empty output that means the process accounting (if installed on the system) is not yet enabled. To have it return its purposed data enable it.

2. accton – Enables or disables accounting

To enable proc accounting:

# accton on /var/account/pact

To disable proc accounting:

# accton off /var/account/pact

3. Enable disable process accounting on Linux boot

On Redhat based Linux distributions accton can be switch on / off on boot up with the good old chkconfig command

On Debian based Ubuntu / Mint etc. distros

To enable process accounging service on boot:

# update-rc.d acct defaults
# /etc/init.d/acct start

Alternatively you can do it on Debian Linux via its config /etc/default/acct:

# cat /etc/default/acct

# Defaults for acct

# If you want to keep acct installed, but not started automatically, set this

# variable to 0. Because /etc/cron.daily/acct calls the initscript daily, it is

# not sufficient to stop acct once after booting if your machine remains up.

ACCT_ENABLE="1"

# Amount of days that the logs are kept.

ACCT_LOGGING="30"

On Redhat RPM distros good old chkconfig is used

# chkconfig psacct on

4. sa command (summary accounting)

# sa

•     3414   54989.71re      64.59cp         0avio     16834k
•       34   54603.57re      61.21cp         0avio     38640k   ***other*
•       14       1.33re       1.29cp         0avio     74725k   ls
•       39      11.88re       1.16cp         0avio     56746k   find
•      149      25.51re       0.83cp         0avio     64912k   spamd
•       16     293.95re       0.06cp         0avio         0k   kworker/dying*
•       22       5.12re       0.01cp         0avio      3951k   sshd
•        3       0.01re       0.01cp         0avio     61611k   awstats.pl
•        2      11.93re       0.00cp         0avio     58288k   ssh
•        3       0.00re       0.00cp         0avio     76224k   php5.6
•        2       0.00re       0.00cp         0avio     75824k   php7.3
•        7       0.65re       0.00cp         0avio     56846k   bash
•        2       0.00re       0.00cp         0avio     75360k   php7.0
•        2       0.00re       0.00cp         0avio     69920k   php8.3
•        4       0.00re       0.00cp         0avio     58032k   mkvalidrcptto
•        2       0.00re       0.00cp         0avio     75408k   php7.4
•        2       0.00re       0.00cp         0avio     69920k   php8.2
•       60       2.02re       0.00cp         0avio     56882k   cron*
•        3       1.24re       0.00cp         0avio     56144k   less
•        2       0.00re       0.00cp         0avio     57272k   dpkg
•        5       0.01re       0.00cp         0avio     23664k   dig
•        3       0.00re       0.00cp         0avio      1443k   lastcomm
•        2       0.31re       0.00cp         0avio       940k   dump-acct
•        2       0.00re       0.00cp         0avio     13702k   php8.0
•        2       0.02re       0.00cp         0avio      1339k   sa
•     1226       1.27re       0.00cp         0avio       631k   watchdog*
•      560       0.00re       0.00cp         0avio      5316k   zabbix_agentd*
•      153       0.00re       0.00cp         0avio     56612k   bash*
•      149       0.12re       0.00cp         0avio     56016k   pwd
•      139       2.04re       0.00cp         0avio       644k   sh
•      128       0.04re       0.00cp         0avio       644k   sessionclean*
•      115       0.00re       0.00cp         0avio       644k   which
•       71       0.00re       0.00cp         0avio     56278k   sed
•       56       0.00re       0.00cp         0avio     56528k   chown
•       39       0.19re       0.00cp         0avio       618k   qmail-queue
•       39       0.00re       0.00cp         0avio       705k   vdelivermail
•       39       0.00re       0.00cp         0avio       590k   qmail-local
•       29       0.53re       0.00cp         0avio     56144k   wc
•       28       0.24re       0.00cp         0avio     56032k   who
•       28       0.00re       0.00cp         0avio       701k   valias
•       28       0.00re       0.00cp         0avio       702k   vuserinfo
•       24      17.13re       0.00cp         0avio      2282k   qmail-smtpd
•       21       5.04re       0.00cp         0avio      3924k   sshd*
•       17       1.16re       0.00cp         0avio     56544k   ping
•       12       0.00re       0.00cp         0avio     56032k   date
•       10       0.00re       0.00cp         0avio     56512k   whoamiSummarizes command usage statistics.

For example to pick up percentage information based on process accounting regarding which process took over most of server’s CPU time

# sa -c

    3414  100.00%   54989.71re  100.00%      64.59cp  100.00%         0avio     16834k

      34    1.00%   54603.57re   99.30%      61.21cp   94.77%         0avio     38640k   ***other*

      14    0.41%       1.33re    0.00%       1.29cp    1.99%         0avio     74725k   ls

      39    1.14%      11.88re    0.02%       1.16cp    1.80%         0avio     56746k   find

     149    4.36%      25.51re    0.05%       0.83cp    1.28%         0avio     64912k   spamd

      16    0.47%     293.95re    0.53%       0.06cp    0.09%         0avio         0k   kworker/dying*

      22    0.64%       5.12re    0.01%       0.01cp    0.02%         0avio      3951k   sshd

       3    0.09%       0.01re    0.00%       0.01cp    0.02%         0avio     61611k   awstats.pl

       2    0.06%      11.93re    0.02%       0.00cp    0.01%         0avio     58288k   ssh

       3    0.09%       0.00re    0.00%       0.00cp    0.00%         0avio     76224k   php5.6

       2    0.06%       0.00re    0.00%       0.00cp    0.00%         0avio     75824k   php7.3

       7    0.21%       0.65re    0.00%       0.00cp    0.00%         0avio     56846k   bash

       2    0.06%       0.00re    0.00%       0.00cp    0.00%         0avio     75360k   php7.0

       2    0.06%       0.00re    0.00%       0.00cp    0.00%         0avio     69920k   php8.3

       4    0.12%       0.00re    0.00%       0.00cp    0.00%         0avio     58032k   mkvalidrcptto

       2    0.06%       0.00re    0.00%       0.00cp    0.00%         0avio     75408k   php7.4

       2    0.06%       0.00re    0.00%       0.00cp    0.00%         0avio     69920k   php8.2

      60    1.76%       2.02re    0.00%       0.00cp    0.00%         0avio     56882k   cron*

       3    0.09%       1.24re    0.00%       0.00cp    0.00%         0avio     56144k   less

       2    0.06%       0.00re    0.00%       0.00cp    0.00%         0avio     57272k   dpkg

       5    0.15%       0.01re    0.00%       0.00cp    0.00%         0avio     23664k   dig

       3    0.09%       0.00re    0.00%       0.00cp    0.00%         0avio      1443k   lastcomm

       2    0.06%       0.31re    0.00%       0.00cp    0.00%         0avio       940k   dump-acct

       2    0.06%       0.00re    0.00%       0.00cp    0.00%         0avio     13702k   php8.0

       2    0.06%       0.02re    0.00%       0.00cp    0.00%         0avio      1339k   sa

    1226   35.91%       1.27re    0.00%       0.00cp    0.00%         0avio       631k   watchdog*

     560   16.40%       0.00re    0.00%       0.00cp    0.00%         0avio      5316k   zabbix_agentd*

     153    4.48%       0.00re    0.00%       0.00cp    0.00%         0avio     56612k   bash*

5. dump-acct (from GNU acct) – Parses the binary files stored on machine

# dump-acct /var/account/pacct

• Outputs detailed info per process in a readable format.

6. Installing the process accounting Tools if not already on the system

On Debian/Ubuntu to install:

# apt install acct

On Red Hat/CentOS to install:

# yum install psacct

File Format Details (Technical details)

The pacct file format is defined in C struct form in kernel headers:

struct acct {

    char ac_flag;

    char ac_version;

    uint16_t ac_tty;

    uint32_t ac_exitcode;

    uint32_t ac_uid;

    uint32_t ac_gid;

    uint32_t ac_pid;

    uint32_t ac_ppid;

    uint32_t ac_btime;

    uint32_t ac_etime;

    uint32_t ac_utime;

    uint32_t ac_stime;

    uint32_t ac_mem;

    uint32_t ac_io;

    char ac_comm[16];

};

(Fields may be compressed using "comp_t" – a 16-bit pseudo-floating point format used to save space.)

7. How to Decode comp_t (Optional)

Fields like ac_utime, ac_stime, ac_etime, ac_mem, and ac_io are often stored in comp_t format:

#define MANTSIZE 13

#define EXPSIZE 3

 

unsigned int expand(comp_t c) {

    return ((c & 0x1FFF) << ((c >> 13) & 0x7));

}

So a comp_t value can be interpreted as:

value = mantissa << (exponent)
 

8. File Growth and Rotation manage

• These files grow over time and can become large.
• Best practice is to rotate and archive them regularly using logrotate or cron jobs.
• Example rotation script (manual):

# mv /var/account/pacct /var/account/pacct.1

# touch /var/account/pacct

# accton /var/account/pacct

Summary what learned

We have learned on what is Process accounting on Linux. The purpose of process accounting is to keep an Audit of what has happened on the Linux server recently thus it is a must to be present on Linux machines, that needs to keep a good history record for potential Security audits like PCI-DSS etc. Here is a short table to recall once again what learned.