I've already written about Linux process accounting under Linux ( see how to keep a detailed audit trail of what's being done on your Linux systems). You can easily setup process accounting under FreeBSD.
FreeBSD Process Accounting
FreeBSD process accounting is a security method in which you can keep track of system resources used, their allocation among users, provide for system monitoring, and minimally track a user's commands.
Turn On FreeBSD Process Accounting
Login as root user and type the following commands. First, turn on FreeBSD accounting service:
echo 'accounting_enable="YES"' >> /etc/rc.conf
Create /var/account/acct accounting file, type:
# touch /var/account/acct
Turn on accounting for current session, enter:
# accton /var/account/acct
How do I start FreeBSD accounting service?
# /etc/rc.d/accounting start
How do I stop FreeBSD accounting service?
# /etc/rc.d/accounting stop
How do I restart FreeBSD accounting service?
# /etc/rc.d/accounting restart
lastcomm -- show last commands executed
lastcomm is really good tool to get information about previously executed commands. Simply type lastcomm to display information about all the command recorded during the current accounting file's lifetime:
lastcomm | less
lastcomm | grep pw
lastcomm - root ttyp0 0.002 secs Thu Jan 8 03:16 lastcomm - root ttyp0 0.008 secs Thu Jan 8 03:16 ls - root ttyp0 0.001 secs Thu Jan 8 03:15 tail -X root ttyp0 0.001 secs Thu Jan 8 03:15 ifconfig - root ttyp0 0.001 secs Thu Jan 8 03:15 w - root ttyp0 0.002 secs Thu Jan 8 03:15 vnstat - root ttyp0 0.001 secs Thu Jan 8 03:15 ls - root ttyp0 0.001 secs Thu Jan 8 03:15 csh -F root ttyp0 0.001 secs Thu Jan 8 03:15 hostname - root ttyp0 0.001 secs Thu Jan 8 03:15 csh -F root ttyp0 0.000 secs Thu Jan 8 03:15 pt_chown - root __ 0.001 secs Thu Jan 8 03:15 sshd -F sshd __ 0.004 secs Thu Jan 8 03:15 sendmail -F root __ 0.004 secs Thu Jan 8 03:15 mail.local - root __ 0.002 secs Thu Jan 8 03:15 sendmail -F root __ 0.004 secs Thu Jan 8 03:15 cron -F root __ 0.003 secs Thu Jan 8 03:15 sendmail - munin __ 0.010 secs Thu Jan 8 03:15 sh - munin __ 0.003 secs Thu Jan 8 03:15 sh - munin __ 0.002 secs Thu Jan 8 03:15 perl - munin __ 0.104 secs Thu Jan 8 03:15 perl - munin __ 0.672 secs Thu Jan 8 03:15 fgrep - munin __ 0.002 secs Thu Jan 8 03:15
Understanding lastcomm command output
For each process entry, the following are printed:
- The name of the user who ran the process.
- Flags, as accumulated by the accounting facilities in the system. The flags are encoded as follows:
- S indicates the command was executed by the super-user.
- F indicates the command ran after a fork but without a following exec().
- D indicates the command terminated with the generation of a core file.
- X indicates the command was terminated with a signal.
List all users who executed rm command
List all users who executed rm command on tty called ttyp0
lastcomm rm ttyp0
List all the executions of commands named foo by user admin on the terminal ttyd0
lastcomm foo root ttyd0
sa -- print system accounting statistics
The sa utility reports on, cleans up, and generally maintains system accounting files.
1135246 1737.686re 47.19cp 0avio 11025k 15919 20.148re 20.04cp 0avio 11857k cc1 193358 7.504re 3.35cp 0avio 3865k sed 497113 42.365re 3.06cp 0avio 393k sh* 726 13.337re 2.64cp 2avio 1729k perl 42784 354.746re 2.52cp 0avio 22328k sh 172 45.643re 1.26cp 816avio 94k rsync* 191 50.127re 1.12cp 622avio 354k rsync
The labels used in the output indicate the following
- avio : Average number of I/O operations per execution
- cp : Sum of user and system time, in minutes
- cpu : Same as cp
- k : CPU-time averaged core usage, in 1k units
- k*sec : CPU storage integral, in 1k-core seconds
- re : Real time, in minutes
- s : System time, in minutes
- tio : Total number of I/O operations
- u : User time, in minutes
sa command comes with lots of other options. Please read man page for further details.
ac -- connect time accounting
A record of individual login and logout are written in /var/log/wtmp. The ac command examines these records and writes the accumulated connect time (in hours) for all logins to the standard output.
Print individual users' totals
Display totals for the given individuals only