Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to figure out how many forks are done and how many concurrent processes are run by each user over time. It does not look like this information is tracked by my distribution.

I know how to sets limits, but I'm interested in tracking these numbers for each user.

share|improve this question
up vote 6 down vote accepted

Try the psacct package (GNU accounting), it should do just about everything you need, once installed and enabled (accton), then lastcomm will keep report on user processes (see also sa and dump-acct). See this for reference: User's executed commands log file

You might need to upgrade the version to log PID/PPID, see http://serverfault.com/questions/334547/how-can-i-enable-pid-and-ppid-fields-in-psacct-dump-acct , otherwise I suspect it will under-report on fork() without exec().

Update If your lastcomm outputs F in the 2nd column it means the process was a fork (that never called exec() to replace itself with a new process). The output of dump-acct should show you the PID (and PPID) in acct v3 format.

An alternative to psacct might be the new(ish) taskstats, there's not a huge amount of support for it yet AFAICT, see Documentation/accounting/taskstats.txt in your kernel version source. This might help get you started http://code.google.com/p/arsenalsuite/wiki/TrackingIOUsage and there's a perl module Linux::Taskstats::Read on CPAN.

In either case you'll need to process the data based on timestamps if you want the concurrent process count per-user.

Update 2 Ok, the things to check for the required psacct support are:

  1. (official) kernel >= 2.6.8 for v3 accounting support (or backport)
  3. v3 capable accounting (psacct) package, as noted above

All of the above should be true in CentOS 6, I've checked a 5.x and it does not have CONFIG_BSD_PROCESS_ACCT_V3=y, so you would have to rebuild your kernel to enable it.

The original psacct-6.3.2 is about 15 years old, the Red Hat/CentOS version has backported v3 and PID display support (I can't test it right now, but it should work).

To check a your kernel config:

zgrep BSD_PROCESS_ACCT /proc/config.gz /boot/config-`uname -r`
share|improve this answer
Process accounting only tracks execs, not forks. – Gilles Feb 13 '13 at 22:37
@Gilles, mine does (psacct-6.4pre1, kernel, Slackware 13). Tested with code that calls fork(), and using bash ( ... ) subshells. Answer updated to clarify. – mr.spuratic Feb 14 '13 at 9:06

You can use ps -ef to look at the child pid, the parent id is the one that did the forking or spawning. You could use watch to run a script on a regular basis and do the counting for you.

share|improve this answer

You can set up the audit subsystem to log forks (and whatever other system call catches your fancy).

auditctl -a exit,always -S clone
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.