Skip to main content

Process Accounting

(26 September 2012)

Process Accounting

# chkconfig psacct on; service psacct start

This will create a file /var/account/pacct which will record processes. It will get rotated; by default 30 days are kept.

You can look at it in a couple ways:

  • lastcomm
    # lastcomm less
    less                    root     pts/2      0.00 secs Wed Sep 26 17:32
    less                    root     pts/2      0.00 secs Wed Sep 26 17:31
    less                    root     pts/2      0.00 secs Wed Sep 26 16:37
    less                    root     pts/2      0.00 secs Wed Sep 26 16:31
    less                    root     pts/2      0.00 secs Wed Sep 26 16:31

dump-acct

# dump-acct /var/account/pacct | grep less
less             |   0.0|   0.0| 519.0|    0|    0|63584.0|Wed Sep 26 16:31:26 2012
less             |   0.0|   0.0|7549.0|    0|    0|63584.0|Wed Sep 26 16:31:33 2012
lesspipe.sh      |   0.0|   0.0|   0.0|    0|    0|63864.0|Wed Sep 26 16:37:58 2012
less             |   0.0|   0.0|54872.0|    0|    0|63584.0|Wed Sep 26 16:37:58 2012
less             |   0.0|   0.0|2096.0|    0|    0|63584.0|Wed Sep 26 17:31:39 2012
less             |   0.0|   0.0|2025.0|    0|    0|63584.0|Wed Sep 26 17:32:19 2012

Important notes:

  • Dump-acct talks in ticks
  • The dates on both applications are the completion time , not the start time.