Sponsored Content
Operating Systems Linux Debian Some commands not logged in pacct Post 302665823 by suvios on Tuesday 3rd of July 2012 08:30:21 AM
Old 07-03-2012
Some commands not logged in pacct

Hi,

Examining the Debian Linux logfiles, I found out that not all commands are logged in my pacct (/var/log/account/pacct)

For instance, if I run and stop Wireshark and do after that

# lastcomm | grep "wireshark"

The wireshark command is logged as expected.

Code:
# lastcomm | grep "wireshark"
wireshark            X user   pts/4      0.68 secs Sun Jul  1 18:55
#

But if i do the same with for instance Gedit, then i got nothing.

Code:
# lastcomm | grep "gedit"
#

What could be the reason for that?


I looked already for quite a long time on the internet for answers but couldn't find them. And all the tutorials talk about the logging of ALL executed commands, not about any exceptions. So, I am a bit confused.

Till now, all the applications i tested where graphical applications of Gnome those are not logged, like:
gedit, gthumb and evolution. So just a thought: Could the reason perhaps lie in the fact that those applications are part of some bigger 'application' that is still running?

Last edited by suvios; 07-03-2012 at 11:36 AM..
 

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

know who logged and logged out with their timings

being ordinary user (not having any administrative rights) can avail myself a facility to know who logged and logged out with their timings get popped onto my terminal as if it get echo 'ed... (3 Replies)
Discussion started by: vkandati
3 Replies

2. Programming

code that reads commands from the standard i/p and executes the commands

Hello all, i've written a small piece of code that will read commands from standard input and executes the commands. Its working fine and is execting the commands well. Accepting arguments too. e.g #mkdir <name of the directory> The problem is that its not letting me change the directory i.e... (4 Replies)
Discussion started by: Phrozen Smoke
4 Replies

3. UNIX for Advanced & Expert Users

su ?? Who logged in First ??

Hi all, Say my login user id is "t007" and I login into the unix server first using my id and password and then I used to use "su" command to switch the user using root user id and password. Now, how the third person will come to know who has logged in as a first user ? As: Login: t007... (2 Replies)
Discussion started by: varungupta
2 Replies

4. Solaris

Can I gzip or delete pacct files in solaris ?

Hi, On my server there are so many pacct files in /var/adm. It is eating up my /var partition. Can I delete or gzip those files ? Thanks NeeleshG (3 Replies)
Discussion started by: neel.gurjar
3 Replies

5. Programming

logged in or logged out?

I have wrote a service with c++ which is always run and now I want to get with it the exact time in that the user log in or log out and then run a script. but the problem is that how could i find that the user logged in or logged out with out checking something frequently? thanks (9 Replies)
Discussion started by: mrhosseini
9 Replies

6. Shell Programming and Scripting

Can BASH execute commands on a remote server when the commands are embedded in shell

I want to log into a remote server transfer over a new config and then backup the existing config, replace with the new config. I am not sure if I can do this with BASH scripting. I have set up password less login by adding my public key to authorized_keys file, it works. I am a little... (1 Reply)
Discussion started by: bash_in_my_head
1 Replies

7. Shell Programming and Scripting

Who are all logged out

I have a situation where I have to capture information of all users who log out, along with the terminal info(tty command). For example, I may have logged in with /dev/pts/2 as well as /dev/pts4. Now, when I log out of the session with /dev/pts/2, I need that to be sent in an email to a... (1 Reply)
Discussion started by: ggayathri
1 Replies

8. Solaris

Require some way or shell in which commands doesnot gets logged in history file

Guys, can u tell me some way in which the commands i execute on solaris system doesnot gets logged. It should not appear in history file.. Is there any shell which provide such solution or can I turn off the logging, if yes then how... Help will be appreciated Thanks (2 Replies)
Discussion started by: harpreetrekhi
2 Replies

9. Shell Programming and Scripting

Script to identify logged users & commands executed

Hi All, I am trying to write a script to get the user information & the command executed. I tried something like this : w | sort | awk '{print$5$6$7}' My requirement is to identify the users who execute the same command at same time. I need the user name & the... (2 Replies)
Discussion started by: vijayarajvp
2 Replies

10. Solaris

Are FSCK commands logged during single user mode?

Who knows if when working in the single user mode that any command are logged or could b elogged specially if I do a fsck I like at least to see when I did start it. (1 Reply)
Discussion started by: manni2
1 Replies
acctsh(1M)						  System Administration Commands						acctsh(1M)

NAME
acctsh, chargefee, ckpacct, dodisk, lastlogin, monacct, nulladm, prctmp, prdaily, prtacct, shutacct, startup, turnacct - shell procedures for accounting SYNOPSIS
/usr/lib/acct/chargefee login-name number /usr/lib/acct/ckpacct [blocks] /usr/lib/acct/dodisk [-o] [filename...] /usr/lib/acct/lastlogin /usr/lib/acct/monacct number /usr/lib/acct/nulladm filename... /usr/lib/acct/prctmp filename /usr/lib/acct/prdaily [-c] [-l] [mmdd] /usr/lib/acct/prtacct filename [ '' heading ''] /usr/lib/acct/shutacct [ '' reason ''] /usr/lib/acct/startup /usr/lib/acct/turnacct on | off | switch DESCRIPTION
chargefee Command chargefee can be invoked to charge a number of units to login-name. A record is written to /var/adm/fee, to be merged with other accounting records by runacct(1M). ckpacct Command ckpacct should be initiated using cron(1M) to periodically check the size of /var/adm/pacct. If the size exceeds blocks, 500 by default, turnacct will be invoked with argument switch. To avoid a conflict with turnacct switch execution in runacct, do not run ckpacct and runacct simultaneously. If the number of free disk blocks in the /var file system falls below 500, ckpacct will automatically turn off the collection of process accounting records via the off argument to turnacct. When at least 500 blocks are restored, the accounting will be activated again on the next invocation of ckpacct. This feature is sensitive to the frequency at which ckpacct is executed, usually by the cron(1M) command. dodisk Command dodisk should be invoked by cron(1M) to perform the disk accounting functions. lastlogin Command lastlogin is invoked by runacct(1M) to update /var/adm/acct/sum/loginlog, which shows the last date on which each person logged in. monacct Command monacct should be invoked once each month or each accounting period. number indicates which month or period it is. If number is not given, it defaults to the current month (01-12). This default is useful if monacct is to executed using cron(1M) on the first day of each month. monacct creates summary files in /var/adm/acct/fiscal and restarts the summary files in /var/adm/acct/sum. nulladm Command nulladm creates filename with mode 664 and ensures that owner and group are adm. It is called by various accounting shell procedures. prctmp Command prctmp can be used to print the session record file (normally /var/adm/acct/nite/ctmp created by acctcon1 (see acctcon(1M)). prdaily Command prdaily is invoked by runacct(1M) to format a report of the previous day's accounting data. The report resides in /var/adm/acct/sum/rprt/mmdd where mmdd is the month and day of the report. The current daily accounting reports may be printed by typing prdaily. Previous days' accounting reports can be printed by using the mmdd option and specifying the exact report date desired. prtacct Command prtacct can be used to format and print any total accounting (tacct)file. shutacct Command shutacct is invoked during a system shutdown to turn process accounting off and append a reason record to /var/adm/wtmpx. startup Command startup can be invoked when the system is brought to a multi-user state to turn process accounting on. turnacct Command turnacct is an interface to accton (see acct(1M)) to turn process accounting on or off. The switch argument moves the current /var/adm/pacct to the next free name in /var/adm/pacct.incr (where incr is a number starting with 0 and incrementing by one for each addi- tional pacct file), then turns accounting back on again. This procedure is called by ckpacct and thus can be taken care of by the cron(1M) command and used to keep pacct to a reasonable size. shutacct uses turnacct to stop process accounting. startup uses turnacct to start process accounting. OPTIONS
The following options are supported: -c This option prints a report of exceptional resource usage by command, and may be used on current day's accounting data only. -l This option prints a report of exceptional usage by login id for the specified date. Previous daily reports are cleaned up and therefore inaccessible after each invocation of monacct. -o This option uses acctdusg (see acct(1M)) to do a slower version of disk accounting by login directory. filenames specifies the one or more filesystem names where disk accounting will be done. If filenames are used, disk accounting will be done on these filesystems only. If the -o option is used, filenames should be mount points of mounted filesystems. If the -o option is omitted, filenames should be the special file names of mountable filesystems. FILES
/etc/logadm.conf Configuration file for the logadm(1M) command /usr/lib/acct Holds all accounting commands listed in section 1M of this manual /usr/lib/acct/ptecms.awk Contains the limits for exceptional usage by command name /usr/lib/acct/ptelus.awk Contains the limits for exceptional usage by login ID /var/adm/acct/fiscal Fiscal reports directory /var/adm/acct/nite Working directory /var/adm/acct/sum Summary directory that contains information for monacct /var/adm/acct/sum/loginlog File updated by last login /var/adm/fee Accumulator for fees /var/adm/pacct Current file for per-process accounting /var/adm/pacctincr Used if pacct gets large and during execution of daily accounting procedure /var/adm/wtmpx History of user access and administration information ATTRIBUTES
See attributes(5) for descriptions of the following attributes: +-----------------------------+-----------------------------+ | ATTRIBUTE TYPE | ATTRIBUTE VALUE | +-----------------------------+-----------------------------+ |Availability |SUNWaccu | +-----------------------------+-----------------------------+ SEE ALSO
acctcom(1), acct(1M), acctcms(1M), acctcon(1M), acctmerg(1M), acctprc(1M), cron(1M), fwtmp(1M), logadm(1M), runacct(1M), acct(2), acct.h(3HEAD), utmpx(4), attributes(5) NOTES
See runacct(1M) for the main daily accounting shell script, which performs the accumulation of connect, process, fee, and disk accounting on a daily basis. It also creates summaries of command usage. SunOS 5.10 15 Mar 2002 acctsh(1M)
All times are GMT -4. The time now is 12:04 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy