In this lesson, you will learn how to monitor system accounting logs to identify who is logging into your server, how long they stay, and what resources they consume during their session.
Understanding System Accounting
While standard logs like /var/log/auth.log track authentication attempts, System Accounting (often provided by the acct or psacct packages) tracks the actual activity of logged-in users. It maintains binary files—typically found in /var/account/pacct or /var/log/account/pacct—that record every command executed and the duration of every login session.
By analyzing this data, you can move beyond knowing if a user logged in to understanding how they utilized the system.
Tracking Activity with lastcomm and sa
The system accounting suite provides tools to interpret these binary logs into human-readable formats:
-
lastcomm: This command displays information about previously executed commands. It shows the user who ran the command, the terminal used, and how much CPU time the process consumed.# View recent command history for a specific user lastcomm username -
sa: This is the summary accounting command. It aggregates the data from the accounting files to provide a bird's-eye view of resource usage per user. You can see the total number of invocations and the aggregate CPU time consumed by each user account.# Display summary report of system usage sudo sa -u
Why This Matters
For a system administrator, these tools are vital for capacity planning and security auditing. If you notice a service account (which you learned to manage in previous lessons) suddenly consuming excessive CPU cycles or executing commands outside of its intended scope, these logs provide the audit trail necessary to investigate potential compromises or misconfigurations. Unlike simple login logs, system accounting captures the "what" behind the session, allowing you to enforce policies regarding resource limits and user behavior more effectively.
Key Takeaway: System accounting transforms raw binary process data into actionable insights, allowing you to audit user behavior and resource consumption beyond simple login timestamps.