Process Accounting
The RedHat package is psacct
It is a service that must be started, ideally at boot time.
Commands to know:
- ac and ac -d for connection times
- lastcomm for a list of processes executed, when, by who, and how much cpu time consumed; searchable ie lastcomm dave or lastcomm ls
- sa specifically sa -u and sa -m although this seems to update only when processes exit.