Linux process accounting psacct

How to Monitor User Activity with psacct or acct Tools

psacct or acct both are open source application for monitoring users activities on the system. These applications runs in the background and keeps track of each users activity on your system as well as what resources are being consumed.

I personally used this program in our company, we have development team where our developers continuously work on servers. So, this is one of best program to keep a eye on them. This program provides an excellent way to monitor what users are doing, what commands are they firing, how much resources are being consumed by them, how long users are active on the system. Another great feature of this program is it gives total resources consumed by services like Apache, MySQL, FTP,SSH etc.

psacct or acct both are open source application for monitoring users activities on the system. These applications runs in the background and keeps track of each users activity on your system as well as what resources are being consumed.

I personally used this program in our company, we have development team where our developers continuously work on servers. So, this is one of best program to keep a eye on them. This program provides an excellent way to monitor what users are doing, what commands are they firing, how much resources are being consumed by them, how long users are active on the system. Another great feature of this program is it gives total resources consumed by services like Apache, MySQL, FTP,SSH etc.

I think this is one of the great and must needed application for every Linux/Unix System Administrators, who wanted to keep a track of user activities on their servers/systems.

The psacct or acct package provides several features for monitoring process activities.

1. ac command prints the statistics of user logins/logouts (connect time) in hours.
2. lastcomm command prints the information of previously executed commands of user.
3. accton commands is used to turn on/off process for accounting.
4. sa command summarizes information of previously executed commands.
5. last and lastb commands show listing of last logged in users.

Installing psacct or acct Packages

psacct or acct both are similar packages and there is not much difference between them, but the psacct package only available for rpm based distributions such as RHEL, CentOS and Fedora, whereas acct package available for distributions like Ubuntu, Debian and Linux Mint.

To install psacct package under rpm based distributions issue the following yum command.

To install acct package using apt-get command under Ubuntu / Debian / Linux Mint.

Starting psacct or acct service

By default psacct service is in disabled mode and you need to start it manually under RHEL/CentOS/Fedora systems. Use the following command to check the status of service.

You see the status showing as disabled, so let’s start it manually using the following both commands. These two commands will create a /var/account/pacct file and start services.

After starting service, check the status again, you will get status as enabled as shown below.

Under Ubuntu, Debian and Mint service is started automatically, you don’t need to start it again.

Display Statistics of Users Connect Time

ac command without specifying any argument will displays total statistics of connect time in hours based on the user logins/logouts from the current wtmp file.

Display Statistics of Users Day-wise

Using command “ac -d” will prints out the total login time in hours by day-wise.

Display Time Totals for each User

Using command “ac -p” will print the total login time of each user in hours.

Display Individual User Time

To get the total login statistics time of user “tecmint” in hours, use the command as.

Display Day-Wise Logn Time of User

The following command will prints the day-wise total login time of user “tecmint” in hours.

Print All Account Activity Information

The “sa” command is used to print the summary of commands that were executed by users.

Explanation

1. 9.86re is a “real time” as per wall clock minutes
2. 0.01cp is a sum of system/user time in cpu minutes
3. 2466k is a cpu-time averaged core usage, i.e. 1k units
4. sshd command name

Print Individual User Information

To get the information of individual user, use the options -u.

Print Number of Processes

This command prints the total number of processes and CPU minutes. If you see continue increase in these numbers, then its time to look into the system about what is happening.

Print Sort by Percentage

The command “sa -c” displays the highest percentage of users.

List Last Executed Commands of User

The ‘latcomm‘ command is used to search and display previously executed user commands information. You can also search commands of individual usernames. For example, we see commands of user (tecmint).

Search Logs for Commands

With the help of the lastcomm command you will be able to view individual use of an each commands.

Источник

How to Monitor User Activity with psacct or acct Tools

psacct or acct both are open source application for monitoring users activities on the system. These applications runs in the background and keeps track of each users activity on your system as well as what resources are being consumed.

I personally used this program in our company, we have development team where our developers continuously work on servers. So, this is one of best program to keep a eye on them. This program provides an excellent way to monitor what users are doing, what commands are they firing, how much resources are being consumed by them, how long users are active on the system. Another great feature of this program is it gives total resources consumed by services like Apache, MySQL, FTP,SSH etc.

I think this is one of the great and must needed application for every Linux/Unix System Administrators, who wanted to keep a track of user activities on their servers/systems.

The psacct or acct package provides several features for monitoring process activities.

1. ac command prints the statistics of user logins/logouts (connect time) in hours.
2. lastcomm command prints the information of previously executed commands of user.
3. accton commands is used to turn on/off process for accounting.
4. sa command summarizes information of previously executed commands.
5. last and lastb commands show listing of last logged in users.

Installing psacct or acct Packages

psacct or acct both are similar packages and there is not much difference between them, but the psacct package only available for rpm based distributions such as RHEL, CentOS and Fedora, whereas acct package available for distributions like Ubuntu, Debian and Linux Mint.

To install psacct package under rpm based distributions issue the following yum command.

To install acct package using apt-get command under Ubuntu / Debian / Linux Mint.

Starting psacct or acct service

By default psacct service is in disabled mode and you need to start it manually under RHEL/CentOS/Fedora systems. Use the following command to check the status of service.

You see the status showing as disabled, so let’s start it manually using the following both commands. These two commands will create a /var/account/pacct file and start services.

After starting service, check the status again, you will get status as enabled as shown below.

Under Ubuntu, Debian and Mint service is started automatically, you don’t need to start it again.

Display Statistics of Users Connect Time

ac command without specifying any argument will displays total statistics of connect time in hours based on the user logins/logouts from the current wtmp file.

Display Statistics of Users Day-wise

Using command “ac -d” will prints out the total login time in hours by day-wise.

Display Time Totals for each User

Using command “ac -p” will print the total login time of each user in hours.

Display Individual User Time

To get the total login statistics time of user “tecmint” in hours, use the command as.

Display Day-Wise Logn Time of User

The following command will prints the day-wise total login time of user “tecmint” in hours.

Print All Account Activity Information

The “sa” command is used to print the summary of commands that were executed by users.

Where

1. 9.86re is a “real time” as per wall clock minutes
2. 0.01cp is a sum of system/user time in cpu minutes
3. 2466k is a cpu-time averaged core usage, i.e. 1k units
4. sshd command name

Print Individual User Information

To get the information of individual user, use the options -u.

Print Number of Processes

This command prints the total number of processes and CPU minutes. If you see continue increase in these numbers, then its time to look into the system about what is happening.

Print Sort by Percentage

The command “sa -c” displays the highest percentage of users.

List Last Executed Commands of User

The ‘latcomm‘ command is used to search and display previously executed user commands information. You can also search commands of individual usernames. For example, we see commands of user (tecmint).

Search Logs for Commands

With the help of the lastcomm command you will be able to view individual use of an each commands.

If You Appreciate What We Do Here On TecMint, You Should Consider:

TecMint is the fastest growing and most trusted community site for any kind of Linux Articles, Guides and Books on the web. Millions of people visit TecMint! to search or browse the thousands of published articles available FREELY to all.

If you like what you are reading, please consider buying us a coffee ( or 2 ) as a token of appreciation.

We are thankful for your never ending support.

Источник

Мониторинг нагрузки пользователей

Я владелец небольшого хостинга (около 200 активных клиентов) и меня заинтересовала тема мониторинга нагрузки на CPU и MySQL.
На некоторых крупных хостингах нагрузка на CPU измеряется в «CP» и на MySQL в «секундах».

Предлагаю Вашему вниманию идею и теоретическую реализацию данной схемы мониторинга на основе Process Accounting и Percona User Statistics.

Нагрузка на CPU

Единица измерения — CP (cpu points). Измеряется системой Process accounting в Linux.

Схема работы

Установим сначала демон psacct (RedHat) или acct (Debian).
yum install psacct или apt-get install acct

Демон собирает информацию по всем выполняемым процессам пользователя и записывает это в /var/account.
Далее, командой sa мы можем получить информацию по каждому пользователю и его нагрузке.
Я использую sa с флагом —user-summary :

Первая строка — общее потребление в системе. Далее, построчно, информация о потребляемых ресурсах каждым пользователем.
В третьем столбце то, что нам нужно, нагрузка на процессор в CP.

Нагрузка на MySQL

Единица измерения — секунды. Измеряется с помощью Percona User Statistics.

Схема работы

Данные каждого запроса записываются в системную таблицу. В нашем случае, к колонке CPU_TIME прибавляется время каждого запроса.

К сожалению, для получения статистики на MySQL 5.5 требуется переустановка MySQL. Я нашел патч User Statistic, но только для MySQL 5.0.77

Вывод информации о нагрузке производится запросом к базе данных INFORMATION_SCHEMA:

Я только начал тестирование данного подхода, который имеет конкретные цифры и алгоритмы расчета нагрузки, но уже видно кого из пользователей можно двигать на тариф выше.

Я реализовал такой подход:

1. Каждый час собирается статистика нагрузки и записывается в таблицу биллинг системы WHMCS.
2. Написанный модуль добавляет вкладку «Нагрузка» для хостинг-услуг.
3. Во вкладке выводим график нагрузки по дням (CPU, MySQL).
4. В случае превышения нагрузки пользователем, высылаем ему уведомления N-раз, в случае отсутствия реакции, производим блокировку аккаунта через API биллинга.

Источник

How to Setup psacct or acct – Monitor User Activity in Linux

It is very important to know what are the activities for applications and users in linux operating system. This will very useful in later time or in case of problems. For this purpose, i would recommend psacct or acct tools to be install. psacct or acct is a free monitoring program to monitor users and applications activity on linux server. This program will display how long user accessing the server, what command are they issuing, how many processes and display logs for commands. psacct and acct are similar tool, psacct is for RPM based linux but acct is for Debian based.

1. If you are runninng Linux CentOS or Redhat, you should use the following command to install pssacct :

But if you are running debian such as Ubuntu, you should install acct package instead of psacct :

2. By default psacct is disabled on Linux. We should manually start it :

Start acct on Debian :

3. The psacct or acct package provides several features for monitoring process activities.

Other usage from that come in psacct or acct package :

ac command prints the statistics of user logins/logouts (connect time) in hours.
lastcomm command prints the information of previously executed commands of user.
accton commands is used to turn on/off process for accounting.
sa command summarizes information of previously executed commands.
last and lastb commands show listing of last logged in users.

4. Total Connect Time :

5. Display the statistics for total login time :

6. Total login statistics of each user :

7. Print the summary of commands that were executed by users :

8. Prints the number of processes and the number of CPU minutes :

9. Use command sa -u to display individual users activity :

10. Printing sort by percentage

The command sa -c will show you the highest percentage of users:

12. Search Logs for Commands :

Related Posts

For those who are forgot their CentOS root password, please do not panic. There was…

As what we wrote in the previous article on how to allow SSH root on…

In this post i will show how password recovery for lost root account’s password is…

By default, the Root account password is locked in Ubuntu and you will not able…

Ubuntu is Debian-based distributions that don’t allow logins by the root user by default, either…

One comment on “ How to Setup psacct or acct – Monitor User Activity in Linux ”

• 

Aasifa

when i executed lastcomm sdiff, i could output is popping multiple times instead of a single display, please help me on this?

]# lastcomm sdiff
sdiff root pts/0 0.00 secs Mon Aug 3 07:52
sdiff root pts/0 0.00 secs Mon Aug 3 07:52
sdiff root pts/0 0.00 secs Mon Aug 3 07:52
sdiff root pts/0 0.00 secs Mon Aug 3 07:52

Источник