ADVERTISEMENT
Responsive Ad Unit • Systems Architecture & Low-Level Engineering

Process Accounting

Process accounting is a kernel feature that records information about completed processes. The collected accounting information helps system administrators, auditors, and monitoring tools analyze how system resources are used.

Learning Objectives

  • Understand process accounting.
  • Learn why accounting is important.
  • Study accounting records.
  • Understand the acct() interface.
  • Learn common applications of accounting.

1. What is Process Accounting?

Process accounting is a facility provided by the operating system that records information about every process after it terminates. Unlike process monitoring, which observes running processes, process accounting stores historical information that can be examined later.

2. Why Process Accounting?

Purpose Description
Auditing Maintain historical execution records.
Billing Measure resource usage for accounting purposes.
Performance Analysis Study process execution characteristics.
Security Track executed programs.
Administration Analyze system utilization.

3. Process Accounting Workflow

Process Starts ↓ Process Executes ↓ Process Terminates ↓ Kernel Creates Accounting Record ↓ Accounting File ↓ Administrator Analysis

4. Accounting Records

Each terminated process contributes one accounting record to the accounting file. The record summarizes information about the completed process instead of recording every event that occurred during execution.

5. Typical Accounting Information

Information Description
Process ID Identifier of the completed process.
User ID Owner of the process.
CPU Time Processor time consumed.
Elapsed Time Total execution duration.
Memory Usage Memory resources used.
Command Name Name of the executed program.
Termination Status Completion information.

6. acct()

The acct() function enables or disables process accounting. When accounting is enabled, the kernel records accounting information for terminated processes in the specified accounting file.

#include <unistd.h> int acct(const char *filename);

7. Return Value

Return Value Description
0 Success.
-1 Error occurred.

8. Enabling Process Accounting

#include <unistd.h> if (acct("/var/account/pacct") == -1) { perror("acct"); }

The specified file becomes the destination for accounting records, subject to the permissions and configuration of the operating system.

9. Disabling Process Accounting

acct(NULL);

Passing NULL disables process accounting. This operation is subject to permission checks performed by the kernel.

10. Interview Questions

  1. What is process accounting?
  2. When is an accounting record created?
  3. What is the purpose of the acct() function?
  4. Which header file declares acct()?
  5. Does process accounting monitor running processes?
  6. What information is typically stored in an accounting record?
  7. How is process accounting disabled?
  8. Who commonly uses process accounting information?
  9. Why is process accounting useful for auditing?
  10. What does acct() return on failure?

11. Accounting File

When process accounting is enabled, the kernel appends one accounting record for every terminated process to the configured accounting file. The accounting file is maintained by the operating system and is intended for later analysis rather than direct manual editing.

12. Accounting Record Contents

Field Description
Command Name Name of the executed program.
Process Identifier Identifier of the completed process.
User Identifier User that executed the program.
Group Identifier Primary group associated with the process.
CPU Time Processor time consumed during execution.
Elapsed Time Total execution duration.
Memory Usage Summary of memory utilization.
Termination Status Completion status of the process.

13. Process Accounting Lifecycle

Program Starts ↓ Kernel Executes Process ↓ Program Terminates ↓ Kernel Collects Statistics ↓ Accounting Record Created ↓ Record Appended ↓ Administrator Reviews Data

14. Example Using acct()

#include <stdio.h> #include <unistd.h> int main(void) { if (acct("/var/account/pacct") == -1) { perror("acct"); return 1; } printf("Process accounting enabled.\n"); return 0; }

15. Error Handling

Applications should always verify the return value of acct(). If the function fails, the reason for the failure can be obtained using errno.

if (acct("/var/account/pacct") == -1) { perror("acct"); }

16. Linux Accounting Utilities

Command Purpose
accton Enable or disable process accounting.
lastcomm Display recently executed commands from accounting records.
sa Generate summary reports from accounting data.

17. Linux Command Examples

sudo accton /var/account/pacct
lastcomm
sa

18. Benefits

Benefit Description
Historical Analysis Review completed process activity.
Resource Tracking Measure CPU and memory usage.
Security Auditing Identify executed programs.
Capacity Planning Analyze long-term workload patterns.
Performance Evaluation Study resource utilization trends.

19. Common Programming Mistakes

  • Ignoring the return value of acct().
  • Assuming accounting is enabled on every system.
  • Attempting to modify the accounting file directly.
  • Ignoring permission requirements.
  • Treating accounting data as real-time monitoring information.

20. Interview Questions

  1. When is an accounting record created?
  2. Which function enables process accounting?
  3. What information is commonly stored in an accounting record?
  4. Why should accounting files not be edited manually?
  5. Which command displays recently executed commands?
  6. What is the purpose of the sa utility?
  7. What does accton do?
  8. Why is process accounting useful for capacity planning?
  9. Can process accounting replace real-time monitoring?
  10. Why should applications check the return value of acct()?

21. Process Accounting vs Process Monitoring

Process Accounting Process Monitoring
Records completed processes. Displays currently running processes.
Historical information. Real-time information.
Used for auditing. Used for administration.
Stores accounting records. Queries active kernel process information.
Examined after execution. Observed while processes execute.

22. Accounting Overhead

Process accounting introduces a small amount of overhead because the kernel must create and write an accounting record whenever a process terminates. Since accounting information is written only once for each completed process, the overhead is generally low.

23. Complete Accounting Workflow

Administrator Enables Accounting ↓ Kernel Starts Recording ↓ User Executes Program ↓ Program Terminates ↓ Kernel Creates Accounting Record ↓ Accounting File Updated ↓ Administrator Reviews History

24. Accounting API Summary

Interface Purpose
acct() Enable or disable process accounting.
accton Linux utility for controlling process accounting.
lastcomm Display command history from accounting records.
sa Generate accounting summaries.

25. Practical Applications

Area Application
Enterprise Servers Audit executed programs.
Universities Track laboratory resource usage.
Cloud Infrastructure Analyze workload history.
Research Systems Measure computation workloads.
Security Review completed commands during investigations.

26. Best Practices

  • Enable process accounting only when required by operational or auditing policies.
  • Protect accounting files using appropriate filesystem permissions.
  • Monitor the size of accounting files to prevent excessive disk usage.
  • Archive accounting records periodically.
  • Analyze accounting data using standard utilities instead of modifying raw records.

27. Common Programming Mistakes

  • Confusing process accounting with real-time monitoring.
  • Assuming every UNIX system enables accounting by default.
  • Ignoring permission requirements for acct().
  • Reading implementation-specific accounting records without considering portability.
  • Failing to monitor accounting file growth.

28. Advanced Interview Questions

  1. How does process accounting differ from process monitoring?
  2. When is an accounting record generated?
  3. Why is process accounting useful for security auditing?
  4. What kind of overhead does process accounting introduce?
  5. Why should accounting files be archived?
  6. Can accounting records be used to monitor running processes?
  7. Why is the accounting record format implementation-dependent?
  8. What is the purpose of the lastcomm utility?
  9. When should an administrator enable process accounting?
  10. Why should raw accounting records not be modified manually?

29. Technical Summary

Concept Summary
Accounting Trigger Process termination.
Storage Kernel-managed accounting file.
Primary Interface acct()
Purpose Historical process information.
Typical Users System administrators and auditors.

30. Quick Interview Review

  1. Which interface enables process accounting?
  2. When is an accounting record written?
  3. What is the difference between accounting and monitoring?
  4. Which Linux utility summarizes accounting records?
  5. Why should accounting files be protected?

31. Process Accounting API Comparison

API / Utility Purpose
acct() Enable or disable process accounting.
accton Linux utility to manage process accounting.
lastcomm Display previously executed commands from accounting records.
sa Generate statistical summaries from accounting data.

32. Linux Command Summary

Command Description
accton file Enable process accounting using the specified accounting file.
accton off Disable process accounting (implementation-dependent syntax).
lastcomm View command execution history.
sa Display summarized accounting statistics.

33. Complete Process Accounting Flow

Administrator Enables Accounting ↓ User Executes Program ↓ Kernel Runs Process ↓ Process Terminates ↓ Kernel Collects Statistics ↓ Accounting Record Generated ↓ Accounting File Updated ↓ Administrator Generates Reports

34. Best Practices Review

  • Enable accounting only when operationally required.
  • Protect accounting files with appropriate filesystem permissions.
  • Monitor accounting file growth to prevent disk exhaustion.
  • Archive or rotate accounting files regularly.
  • Use standard administrative utilities to analyze accounting records.
  • Always verify the return value of acct().

35. Common Administrative Mistakes

  • Leaving accounting enabled indefinitely without monitoring disk usage.
  • Deleting accounting files while accounting is active.
  • Assuming accounting provides real-time monitoring.
  • Ignoring permission failures when enabling accounting.
  • Treating implementation-specific record formats as portable.

36. Advanced Interview Questions

  1. Why is process accounting considered a historical logging mechanism?
  2. How does process accounting differ from system auditing?
  3. What information is typically contained in an accounting record?
  4. Why is the accounting record format implementation-dependent?
  5. What happens if acct() fails?
  6. Why should accounting files be rotated periodically?
  7. Which Linux utilities analyze accounting records?
  8. Can process accounting record processes that are still running?
  9. What are the advantages of historical process accounting?
  10. Why is process accounting useful in capacity planning?

37. Module Summary

This module introduced UNIX process accounting and explained how the kernel records information about completed processes. It covered the acct() interface, accounting records, kernel workflow, Linux accounting utilities, historical analysis, administrative best practices, and common implementation considerations. Process accounting provides valuable information for auditing, resource analysis, security investigations, and long-term capacity planning.

Next Module

The Process Accounting module is now complete. Continue to the next chapter: Advanced Process Scheduling

Next → Advanced Process Scheduling
Knowledge Check

Concept Mastery Assessment — Module 35

Verify your conceptual understanding with 12 targeted technical assessment questions. Instant feedback and explanations are provided for every choice.

Question 1 of 12
What is the primary architectural purpose of Process Accounting & Audit Infrastructure in operating systems?
Explanation
Process Accounting & Audit Infrastructure is designed to manage kernel bsd process accounting records (struct acct), accton system call, resource usage auditing, and pacct file decoding. within the operating system architecture.
Question 2 of 12
Which system interface or data structure is centrally associated with Process Accounting & Audit Infrastructure?
Explanation
Under POSIX and Linux, Process Accounting & Audit Infrastructure operates through standardized system calls and kernel control structures.
Question 3 of 12
What safety or concurrency constraint must developers consider when implementing Process Accounting & Audit Infrastructure?
Explanation
Proper synchronization, avoidance of race conditions, and handling reentrant execution are critical when working with Process Accounting & Audit Infrastructure.
Question 4 of 12
When a system call related to Process Accounting & Audit Infrastructure fails in C, how does the POSIX runtime conventionally report the failure?
Explanation
Standard POSIX system calls return -1 or NULL on error, assigning an error integer (e.g. EINVAL, EPERM, EAGAIN) to the thread-local errno variable.
Question 5 of 12
What is the primary performance tradeoff associated with Process Accounting & Audit Infrastructure?
Explanation
Operations involving Process Accounting & Audit Infrastructure balance performance against kernel transition, memory bandwidth, and cache locality tradeoffs.
Question 6 of 12
What security principle governs access to resources in Process Accounting & Audit Infrastructure?
Explanation
The kernel validates credentials, effective permissions, and Linux capabilities before granting access to protected operations.
Question 7 of 12
How does execution of Process Accounting & Audit Infrastructure transition between User Space and Kernel Space?
Explanation
User space transitions to kernel mode securely via software traps or SYSCALL instructions that switch processor rings to Ring 0.
Question 8 of 12
What happens to resources allocated by Process Accounting & Audit Infrastructure when the owning process terminates?
Explanation
Process resources (open fds, memory maps) are automatically reclaimed by the kernel on termination, while kernel-persistent objects survive.
Question 9 of 12
In production Linux server environments, how is Process Accounting & Audit Infrastructure optimized for high throughput?
Explanation
Linux optimizes throughput via zero-copy data paths, asynchronous kernel events, and scalable concurrency primitives.
Question 10 of 12
What standard governs the portability of Process Accounting & Audit Infrastructure across Unix, Linux, and macOS platforms?
Explanation
IEEE POSIX standards define consistent APIs across Unix-like platforms ensuring portable source code execution.
Question 11 of 12
Which command-line diagnostic tool is most effective for inspecting and troubleshooting Process Accounting & Audit Infrastructure at runtime?
Explanation
Utilities like strace, lsof, and the /proc filesystem provide direct visibility into kernel interactions and resource status.
Question 12 of 12
What is a critical production best practice when developing systems software involving Process Accounting & Audit Infrastructure?
Explanation
Defensive programming requires explicit error checking on all system operations, proper resource cleanup, and avoiding memory corruption.
0 / 12 (0%)
Great job! Review the concepts above and proceed when ready.
ADVERTISEMENT
Responsive Ad Unit • Technical Courses & Certifications