4

I have installed the acct package and it is running because I can see file activity in the log file. I know there is the command accton on to turn it on, but how do I determine that its running short of checking that there is activity in the log file?

I believe from my reading that there is no daemon running as the accounting is managed as part of the kernel and this program simply enables the activity to be logged.

PS: There is no process called "acct"

3 Answers 3

2

I don't think there's any better method than just observing the log file growing or failing to grow. And that's not foolproof since the accounting can be sent to an alternate file. and even on a normal system with nothing weird happening there'll be a cron job that stops accounting, rotates the log, and restarts it so there's a brief window where you'll get the wrong answer.

Maybe there should be a symlink to the current accounting file somewhere in /proc, but there isn't one.

2

I'm on CentOS and it uses psacct.

psacct runs as a service so you can:

 service psacct status

and you can check for the lockfile: /var/lock/subsys/psacct

I think it runs in kernel space and I think its actually designed to be hard to tell if it's running or turned on (if you use a nondescript accounting file and change the location of the lockfile in the startup script) This makes it a very useful tool for doing forensics on a pwned box.

1

You are right: there is no process associated with system accounting, this is an internal kernel function which is directly writing on a system accounting file, which on many Unixes is /var/account/acct. There is no system call to get a status of this internal kernel function.

The sure way to check that the system accounting is on is to use the standard Unix command lastcomm twice. The first process will be registered within the system accounting file, the second will confirm you that the last terminated and registered process is lastcomm.

On an heavily loaded server, and most notably on multiprocessors, the 2nd lastcomm may display some more other terminated processes before displaying the 1st lastcomm. This is normal.

Here is my best shell function to get a status of accounting being on:

is_acct_on() {
    t=`mktemp /tmp/acct.XXXX`
    touch ${t}
    sleep 1
    x=`find /var/account -newercc ${t} -name "acct" | head -1`
    rm ${t}
    [ -z "${x}" ]
}

usage:

is_acct_on

return 0 if accounting is off

1 if accounting is on.

1
  • lastcomm assumes the default accounting file location, so if it's been redirected it won't detect the logging.
    – gerardw
    Jan 25, 2019 at 13:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .