Linux server administration/acct

Acct package allows to activate process accounting in Linux. Installing acct package in Ubuntu activates accounting by default.

• Configuration: /etc/default/acct
• Logs file: /var/log/account/pacct

1. Install in Ubuntu acct accounting package and deactivate it changing ACCT_ENABLE="1" to ACCT_ENABLE="0" in /etc/default/acct and stopping it /etc/init.d/acct stop
2. Activate accounting by executing accton on and deactivate it by executing accton off and check status service acct status

grep -w acct /var/log/syslog
Jul 29 14:22:00 machine-name acct[23114]: Turning on process accounting, file set to '/var/log/account/pacct'.
Jul 29 14:22:00 machine-name acct[23114]:  * Done.
Jul 29 15:02:15 machine-name acct[12629]: Turning off process accounting.
Jul 29 15:02:15 machine-name acct[12629]:  * Done.

• atop
• sar
• auditd (https://linux.die.net/man/8/auditd) allows to retrieve audit records such as system-calls from the kernel
• Linux server administration/Performance and Troubleshooting