How to know if acct is running? (The Unix system accounting)

auditprocess

I have installed the acct package and it is running because I can see file activity in the log file. I know there is the command accton on to turn it on, but how do I determine that its running short of checking that there is activity in the log file?

I believe from my reading that there is no daemon running as the accounting is managed as part of the kernel and this program simply enables the activity to be logged.

PS: There is no process called "acct"

Best Answer

I don't think there's any better method than just observing the log file growing or failing to grow. And that's not foolproof since the accounting can be sent to an alternate file. and even on a normal system with nothing weird happening there'll be a cron job that stops accounting, rotates the log, and restarts it so there's a brief window where you'll get the wrong answer.

Maybe there should be a symlink to the current accounting file somewhere in /proc, but there isn't one.