1

I'm trying to monitor a user's activities on my Debian server. I found, after Googling that the acct package should help me log all commands and let me filter them by user.

I installed the package, some features seem to work (like the ac command). But the most important one for me: lastcomm shows no results:

root@myserver:~# ac
    total        7.75
root@myserver:~# sa
root@myserver:~# lastcomm
root@myserver:~#

I believe it logs all activities in /var/log/account/pacct am I right?

root@myserver:~# ls -l /var/log/account/     
total 0
-rw-r----- 1 root adm 0 Aug 23 14:33 pacct
-rw-r----- 1 root adm 0 Aug 23 14:23 pacct.0

I also found sources saying it logs in /var/account/pacct but that file/directory doesn't exist.

I'm out of ideas here, so anyone?

Bart Vangeneugden
  • 121
  • 5
  • What happens if you run `accton` directly? I'm having a similar problem with Debian Lenny, but when I run `/usr/sbin/accton /var/log/account/pacct`, I get `Operation not permitted` as root. Still trying to get to the bottom of it, but `/etc/init.d/acct` masks this error message. So run manually, and see if accton kicks something similar out. – Chris J Nov 28 '11 at 19:42
  • Is this solved yet? – tshepang Oct 10 '13 at 05:31

2 Answers2

2

As you can see from the above output, pacct size is 0 byte. Start the psacct/acct service, doing something and try again.

quanta
  • 50,327
  • 19
  • 152
  • 213
0

Verify that the cron scripts have been added in /etc/cron.daily and /etc/cron.monthly. Then launch the daily script to begin the accounting.

DrGkill
  • 936
  • 6
  • 7