Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to monitor a user's activities on my Debian server. I found, after Googling that the acct package should help me log all commands and let me filter them by user.

I installed the package, some features seem to work (like the ac command). But the most important one for me: lastcomm shows no results:

root@myserver:~# ac
    total        7.75
root@myserver:~# sa
root@myserver:~# lastcomm
root@myserver:~#

I believe it logs all activities in /var/log/account/pacct am I right?

root@myserver:~# ls -l /var/log/account/     
total 0
-rw-r----- 1 root adm 0 Aug 23 14:33 pacct
-rw-r----- 1 root adm 0 Aug 23 14:23 pacct.0

I also found sources saying it logs in /var/account/pacct but that file/directory doesn't exist.

I'm out of ideas here, so anyone?

share|improve this question
    
What happens if you run accton directly? I'm having a similar problem with Debian Lenny, but when I run /usr/sbin/accton /var/log/account/pacct, I get Operation not permitted as root. Still trying to get to the bottom of it, but /etc/init.d/acct masks this error message. So run manually, and see if accton kicks something similar out. –  Chris J Nov 28 '11 at 19:42
    
Is this solved yet? –  Tshepang Oct 10 '13 at 5:31

2 Answers 2

As you can see from the above output, pacct size is 0 byte. Start the psacct/acct service, doing something and try again.

share|improve this answer
    
I started the service like service acct start and ran some commands as a user. It stays empty –  Bart Vangeneugden Aug 25 '11 at 9:44
    
Make sure that your running kernel supports process accounting: grep -i process_acct /path/to/kernel/.config. –  quanta Aug 25 '11 at 10:04
    
Hm, I'm having trouble finding my kernel. /usr/src/ seems empty. This is some rented VPS by the way –  Bart Vangeneugden Aug 25 '11 at 10:29
    
Determine which VPS you are running with virt-what –  quanta Aug 25 '11 at 10:39

Verify that the cron scripts have been added in /etc/cron.daily and /etc/cron.monthly. Then launch the daily script to begin the accounting.

share|improve this answer
    
Cron scripts are active. I ran them, sadly no result –  Bart Vangeneugden Aug 25 '11 at 9:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.