Linux Terminology – What Does Process Accounting Mean

containerlinuxterminology

I'm working with Docker in action's book, and I have seen the term "process accounting" several times. I am in a containerization of the application context.
I would like to know more about this concept of process accounting. Google found me some finance accounting articles; I am looking for the meaning related to computer systems.

Would you please provide some explanation about this concept?

Best Answer

The Linux kernel has a built-in process accounting facility. It allows system administrators to collect detailed information in a log file each time a program is executed on a Linux system. Then the administrator can analyze the data in these log files and find a conclusion. To shed more light on this term, let me give few examples:

  • The administrator can collect information about who has been playing games on a Linux computer and for how long.
  • One of the earliest uses of process accounting was to calculate the CPU time absorbed by users at computer installations and then bill users accordingly.
  • Another example is when process accounting can be turned on for a week to record the names of all the commands executed in a log file. The administrator can then parse the log file to find out which command was run most often.
  • The most typical application of process accounting is as a supplement to system security measures. In the case of a break-in on a company server, the log files created by the process accounting facility are useful for collecting forensic evidence.

Turning on process accounting requires significant disk space. For example, on a Pentium III system with Red Hat 7.2, each time a program is executed, 64 bytes of data are written to the process accounting log file.

Process accounting commands are as follows:

**Command Name**    **Purpose**
accton              Enables or disables process accounting
acctentries         Counts the number of accounting entries in the log file
accttrim            Truncates the accounting file specified
dumpacct            Dumps the contents of the log file
dump-acct           Similar to dumpacct
handleacct.sh       Script to compress and backup logs and delete the oldest
lastcomm            Prints commands executed on the system, most recent first
sa                  Summarize accounting information

More information about installation and utilization of process accounting can be found in this Linux Journal article.

Related Question