How to use psacct or acct Tools in Linux
To Monitor User Activity with psacct or acct Tools in Linux
Steps to monitor User Activity with psacct or acct Tools is explained in this article. This application runs in the background that track the each users activity in the system.
Features
ac - used to prints the statistics of user logins/logouts in hours.
lastcomm - used to prints the previously executed commands information.
accton - used to turn on/off accounting process.
sa - to get information of commands, which is previously executed.
last and lastb - it shows the list of user' s last logged.
To Install psacct or acct Packages
Run the following command to install psacct package.
[root@linuxhelp ~]# dnf install psacct
Last metadata expiration check performed 0:16:28 ago on Wed May 25 12:19:21 2016.
Dependencies resolved.
================================================================================
Package Arch Version Repository Size
================================================================================
Installing:
psacct x86_64 6.6.2-3.fc23 fedora 98 k
Transaction Summary
================================================================================
Install 1 Package
Total download size: 98 k
Installed size: 203 k
Is this ok [y/N]: y
Downloading Packages:
[MIRROR] psacct-6.6.2-3.fc23.x86_64.rpm: Curl error (7): Couldn' t connect to server for http://kartolo.sby.datautama.net.id/fedora/releases/23/Everything/x86_64/os/Packages/p/psacct-6.6.2-3.fc23.x86_64.rpm [Failed to connect to kartolo.sby.datautama.net.id port 80: Connection refused]
psacct-6.6.2-3.fc23.x86_64.rpm 62 kB/s | 98 kB 00:01
--------------------------------------------------------------------------------
Total 28 kB/s | 98 kB 00:03
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
Installing : psacct-6.6.2-3.fc23.x86_64 1/1
Verifying : psacct-6.6.2-3.fc23.x86_64 1/1
Installed:
psacct.x86_64 6.6.2-3.fc23
Complete!
To Start psacct or acct service
Start psacct service manually and check the status of service by using the following command.
[root@linuxhelp ~]# systemctl start psacct.service
[root@linuxhelp ~]# systemctl status psacct.service
? psacct.service - Kernel process accounting
Loaded: loaded (/usr/lib/systemd/system/psacct.service disabled vendor preset: disabled)
Active: active (exited) since Wed 2016-05-25 12:38:41 BST 1min 6s ago
Process: 3891 ExecStart=/usr/sbin/accton /var/account/pacct (code=exited, status=0/SUCCESS)
Process: 3888 ExecStartPre=/usr/libexec/psacct/accton-create (code=exited, status=0/SUCCESS)
Main PID: 3891 (code=exited, status=0/SUCCESS)
May 25 12:38:41 linuxhelp systemd[1]: Starting Kernel process accounting...
May 25 12:38:41 linuxhelp accton[3891]: Turning on process accounting, file ....
May 25 12:38:41 linuxhelp systemd[1]: Started Kernel process accounting.
May 25 12:39:07 linuxhelp systemd[1]: Started Kernel process accounting.
Hint: Some lines were ellipsized, use -l to show in full.
To Display Statistics of Users Connect Time
The total statistics of connect time in hours based on the user logins/logouts from the current wtmp file will be displayed by using the ' ac' command without specifying any argument.
[root@linuxhelp ~]# ac
total 29.49
To Display Statistics of Users Day-wise
To list out the total login time in hours by day-wise use ' ac -d' command.
[root@linuxhelp ~]# ac -d
May 18 total 11.20
May 21 total 17.83
Today total 0.48
To Display Time Totals for each User
Print the total login time of each user in hours, run the ' ac -p' command.
[root@linuxhelp ~]# ac -p
user1 29.51
total 29.51
To Display Individual User Time
Use the following command, to get the users total login statistics time.
[root@linuxhelp ~]# ac user1
total 29.04
To Display Day-Wise Logn Time of User
Print the users day-wise total login time in hours by using the following command.
[root@linuxhelp ~]# ac -d user1
May 18 total 11.20
May 21 total 17.83
Today total 0.02
To Print All Account Activity Information
List all the summary of commands which is executed by users, use the ' sa' command.
[root@linuxhelp ~]# sa
262 18.69re 0.12cp 0avio 25393k
2 18.63re 0.11cp 0avio 0k kworker/dying*
2 0.01re 0.01cp 0avio 90672k dnf
117 0.02re 0.00cp 0avio 22032k pkla-check-auth
96 0.00re 0.00cp 0avio 30144k bash*
19 0.00re 0.00cp 0avio 31344k sed
6 0.00re 0.00cp 0avio 2375k lastcomm
5 0.00re 0.00cp 0avio 1081k ac
4 0.01re 0.00cp 0avio 67454k ***other*
4 0.00re 0.00cp 0avio 2118k sa
3 0.01re 0.00cp 0avio 33312k systemctl
2 0.00re 0.00cp 0avio 522k accton
2 0.00re 0.00cp 0avio 2738k systemd-cgroups
To Print Individual User Information
Execute the options ' -u' to know the information of individual user.
[root@linuxhelp ~]# sa -u
root 0.00 cpu 1044k mem 0 io accton
root 0.00 cpu 4376k mem 0 io systemd-tty-ask
root 0.00 cpu 71152k mem 0 io pkttyagent
root 0.00 cpu 33312k mem 0 io systemctl
root 0.00 cpu 30144k mem 0 io bash *
root 0.00 cpu 30144k mem 0 io bash *
polkitd 0.01 cpu 22032k mem 0 io pkla-check-auth
polkitd 0.01 cpu 22032k mem 0 io pkla-check-auth
.
.
.
.
root 0.00 cpu 30144k mem 0 io bash *
root 0.00 cpu 31344k mem 0 io sed
root 0.00 cpu 30144k mem 0 io bash *
root 0.00 cpu 30144k mem 0 io bash *
root 0.00 cpu 30144k mem 0 io bash *
root 0.00 cpu 30144k mem 0 io bash *
root 0.00 cpu 33312k mem 0 io systemctl
root 0.00 cpu 0k mem 0 io accton
To Print Number of Processes
Execute the below command to print the total number of processes and CPU minutes.
[root@linuxhelp ~]# sa -m
262 18.69re 0.12cp 0avio 25393k
root 145 18.67re 0.12cp 0avio 28104k
polkitd 117 0.02re 0.00cp 0avio 22032k
To Print Sort by Percentage
To print the highest percentage of users then execute the ' sa -c' command.
[root@linuxhelp ~]# sa -c
262 100.00% 18.69re 100.00% 0.12cp 100.00% 0avio 25393k
2 0.76% 18.63re 99.69% 0.11cp 86.72% 0avio 0k kworker/dying*
2 0.76% 0.01re 0.07% 0.01cp 9.89% 0avio 90672k dnf
117 44.66% 0.02re 0.10% 0.00cp 3.39% 0avio 22032k pkla-check-auth
96 36.64% 0.00re 0.02% 0.00cp 0.00% 0avio 30144k bash*
19 7.25% 0.00re 0.00% 0.00cp 0.00% 0avio 31344k sed
6 2.29% 0.00re 0.00% 0.00cp 0.00% 0avio 2375k lastcomm
5 1.91% 0.00re 0.00% 0.00cp 0.00% 0avio 1081k ac
4 1.53% 0.01re 0.05% 0.00cp 0.00% 0avio 67454k ***other*
4 1.53% 0.00re 0.00% 0.00cp 0.00% 0avio 2118k sa
3 1.15% 0.01re 0.05% 0.00cp 0.00% 0avio 33312k systemctl
2 0.76% 0.00re 0.00% 0.00cp 0.00% 0avio 522k accton
2 0.76% 0.00re 0.00% 0.00cp 0.00% 0avio 2738k systemd-cgroups
To List Last Executed Commands of User
Previously executed user commands information can be searched and viewed by using the ' lastcomm' command.
[root@linuxhelp ~]# lastcomm root
accton root __ 0.00 secs Wed May 25 12:28
systemctl S root pts/0 0.00 secs Wed May 25 12:28
bash F root pts/0 0.00 secs Wed May 25 12:28
bash F root pts/0 0.00 secs Wed May 25 12:28
bash F root pts/0 0.00 secs Wed May 25 12:28
.
.
.
bash F root pts/0 0.00 secs Wed May 25 12:22
systemctl S root pts/0 0.00 secs Wed May 25 12:22
pkttyagent X root pts/0 0.00 secs Wed May 25 12:22
systemd-tty-ask root pts/0 0.00 secs Wed May 25 12:22
accton S root __ 0.00 secs Wed May 25 12:22
To Search Logs for Commands
View the individual use of an each commands by using the ' lastcomm' command.
[root@linuxhelp ~]# lastcomm bash
bash F root pts/0 0.00 secs Wed May 25 12:28
bash F root pts/0 0.00 secs Wed May 25 12:28
bash F root pts/0 0.00 secs Wed May 25 12:28
bash F root pts/0 0.00 secs Wed May 25 12:28
bash F root pts/0 0.00 secs Wed May 25 12:28
bash F root pts/0 0.00 secs Wed May 25 12:27
.
.
.
.
bash F root pts/0 0.00 secs Wed May 25 12:22
bash F root pts/0 0.00 secs Wed May 25 12:22
bash F root pts/0 0.00 secs Wed May 25 12:22
bash F root pts/0 0.00 secs Wed May 25 12:22
bash F root pts/0 0.00 secs Wed May 25 12:22
bash F root pts/0 0.00 secs Wed May 25 12:22
bash F root pts/0 0.00 secs Wed May 25 12:22
Tag :
Monitoring tool
Q
How to List Last Executed Commands of User using psacct or acct Tools?
A
Previously executed user commands information can be searched and viewed by using the ' lastcomm' command using psacct or acct Tools
Q
How To Display Statistics of Users Day-wise using psacct or acct Tools in Linux?
A
To list out the total login time in hours by day-wise use ' ac -d' command.
Q
How to To Display Statistics of Users Connect Time?
A
The total statistics of connect time in hours based on the user logins/logouts from the current wtmp file will be displayed by using the ' ac' command without specifying any argument.
Q
How to start Start psacct or acct service ?
A
Start psacct service manually and check the status of service by using the following command.
systemctl start psacct.service
systemctl status psacct.service
systemctl start psacct.service
systemctl status psacct.service
Q
how to monitor the users who were logged in my linux server?
A
To monitor the users who were logged in use "w" or "who" command.