acct
logs execution of all processes, and the users that execute them, recording statistics such as real time elapsed, and CPU time elapsed. I have seen it suggested that this might be useful in a forensic context, i.e. working out who executed what, and when. But as it just records the name of the process, I'm wondering what value it really adds.
If I execute
$ cp /usr/bin/cc vi
$ ./vi malware.c -o ls
$ ./ls
then the process accounting log will only contain entries named "cp", "vi", and "ls" - all innocuous.
Therefore process accounting appearas to offer limited security benefits. Any contrary opinions?