1. Accounting Accounting collects information about users and processes
useful data for monitoring a system
Unix accounting is remarkably comprehensive
Accounting uses up vast amount of disk space
/var/log/wtmp historical list of user logins
/var/log/savacct summary of system process accounting command
/var/log/useracct summary of system process accounting user
/var/log/sa system accounting log storage
If accounting is enabled run cron jobs to gather data
data collection resets the wtmp and pacct files
accounting usually started by /etc/init.d/acct
Commands Function
sa summary accounting for system and user
ac user accounting
accton start and stop accounting
In order to use accounting you need to install package called acct:
emerge –s acct
Accounting is normally switched on and off when the system runs in multi-user mode (sometimes enabled for higher run levels like 3 or 4 so that accounting can be used selectively).
To enable accounting at system boot:
rc-update add acct default
To start accounting now directly:
/etc/init.d/acct start
You must have kernel support for accounting. You might have the pleasure to recompile your kernel.
Whilst preparing kernel with menuconfig this is found in:
General Setup ->
BSD Process Accounting
BSD Process Accounting version 3 file format
Auditing Support
Enable system-call auditing support

2. Display system accounting
Use sa to display system accounting data
Command show resoucres used in system
Useful options
-a Force sa not to sort those command names with unprintable characters and those used
-c Print percentages of total time for the command's user, system, and real time values.
-d Sort the output by the average number of disk I/O operations.
-k Sort the output by cpu time average memory usage.
-m Print the number of processes and number of CPU minutes on a per-user basis.
-t For each entry, print the ratio of real time to the sum of system and user times.
-u For each command in the accounting file, print the userid and command name.
sa summarizes information about previously executed commands as recorded in the acct file.In addition, it condenses this data into a summary file named savacct which contains the number of times the command was called and the system resources used. The information can also be summarized on a per-user basis; sa will save this information into a file named usracct.
If no arguments are specified, sa will print information about all of the commands in the acct file.
If called with a file name as the last argument, sa will use that file instead of the system's default acct file.
By default, sa will sort the output by sum of user and system time. If command names have unprintable characters, or are only called once, sa will sort them into a group called `***other'. If more than one sorting option is specified, the list will be sorted by the one specified last on the command line.
To make sa work proper, you must collect data at periodic intervals, fx with crontab:
Add a textfile with this content in /etc/cron.d/sysstat:
# Run system activity accounting tool every 10 minutes */10 * * * * root /usr/lib/sa/sa1 -d 1 1 # 0 * * * * root /usr/lib/sa/sa1 -d & # Generate a daily summary of process accounting at 23: * * * root /usr/lib/sa/sa2 -A

3. Display user accounting
Use ac to display user accounting data
Useful options
-d, --daily-totals connect time in hours
Print totals for each day rather than just one big total at the end. The output
looks like this:
Jul 3 total
Jul 4 total
Jul 5 total
Jul 6 total
Jul 7 total
-p, --individual-totals
Print time totals for each user in addition to the usual everything-lumped-into-one
value. It looks like:
bob
goff
maley
root
total
ac prints out a report of connect time (in hours) based on the logins/logouts in the current wtmp file. A total is also printed out.
The accounting file wtmp is maintained by init(8) and login(1). Neither ac nor login cre¡ates the wtmp if it doesn't exist, no accounting is done. To begin accounting, create the file with a length of zero.
NOTE: Fhe wtmp file can get really big, really fast. You might want to trim it every once
and a while.