Unix - UNIX Accounting and User Activity Monitoring

UNIX accounting and user activity monitoring refer to the process of recording and analyzing user actions, system resource usage, and login history. These features help system administrators understand how the system is being used, identify performance issues, detect unauthorized activities, and generate usage reports. Unlike simple logging, accounting provides structured records that can be analyzed for auditing, security, and resource management purposes.

UNIX systems include accounting mechanisms that track user logins, executed commands, process execution times, and resource consumption. This information is especially valuable in multi-user environments such as universities, enterprises, research laboratories, and shared servers where multiple users access the same system. By maintaining accurate records, administrators can ensure accountability and improve overall system management.

Purpose of UNIX Accounting

The primary purpose of UNIX accounting is to maintain a historical record of user activities. It enables administrators to monitor system usage, investigate security incidents, and analyze resource consumption patterns. Accounting records also help organizations comply with security policies and auditing requirements.

For example, if a system experiences unusually high CPU usage during a particular time, accounting records can help determine which user and which command were responsible for consuming the resources.

Types of UNIX Accounting

UNIX accounting is generally divided into three major categories:

1. Process Accounting

Process accounting records every command executed by users. Each record contains details such as:

  • Username

  • Command name

  • CPU time used

  • Memory consumed

  • Execution duration

  • Exit status

Process accounting is useful for understanding which applications consume the most resources and identifying inefficient programs.

Example:

If a user executes:

find / -name "*.log"

The accounting system records the execution details even after the command has finished.

2. Login Accounting

Login accounting records every user login and logout session. It stores information such as:

  • Username

  • Login time

  • Logout time

  • Terminal used

  • Remote IP address (if applicable)

  • Session duration

Administrators use login accounting to determine when users accessed the system and how long they remained logged in.

Useful commands include:

last

Displays recent login history.

Example output:

john    pts/0   192.168.1.10   Mon Jul 1 09:15 - 17:30
alice   pts/1   192.168.1.15   Mon Jul 1 10:05 - 16:45

Another useful command is:

who

which shows users currently logged into the system.

3. Disk Accounting

Disk accounting monitors how much storage each user consumes. It helps administrators manage disk quotas and prevent individual users from occupying excessive storage space.

Disk accounting information includes:

  • Total disk usage

  • Number of files owned

  • Available storage

  • User quotas

Example command:

du -sh /home/username

This command displays the total disk usage for a user's home directory.

Important Accounting Files

UNIX stores accounting information in several system files.

utmp

Contains information about users currently logged into the system.

Typical location:

/var/run/utmp

wtmp

Stores historical login and logout records.

Typical location:

/var/log/wtmp

The last command reads data from this file.

btmp

Stores failed login attempts.

Typical location:

/var/log/btmp

Administrators use this file to detect unauthorized login attempts.

Enabling Process Accounting

Many UNIX systems provide process accounting software such as acct or psacct.

On Linux-based UNIX systems, administrators may install the package and start the accounting service.

Example:

sudo systemctl start psacct

or

sudo systemctl start acct

Once enabled, every executed command is automatically recorded.

Viewing Accounting Reports

Several utilities are available to analyze accounting records.

sa

Summarizes command execution statistics.

Example:

sa

Sample information displayed includes:

  • Total number of commands executed

  • CPU time consumed

  • Average execution time

  • Frequently used commands

lastcomm

Displays previously executed commands.

Example:

lastcomm

Possible output:

ls       john    pts/0
gcc      alice   pts/1
python   david   pts/2

Monitoring Active Users

Several commands help administrators monitor current user activity.

Using:

who

Displays:

  • Username

  • Login terminal

  • Login time

Using:

w

Provides additional information including:

  • Current activity

  • System load

  • Idle time

  • Running processes

Example:

USER   TTY   LOGIN   IDLE   JCPU   PCPU   WHAT
john   pts/0 09:15   2:00   0.15s  0.05s  vim report.txt

Monitoring Running Processes

Process monitoring complements accounting by showing currently active programs.

Useful commands include:

ps

Lists active processes.

top

Displays real-time CPU and memory usage.

htop

Provides an interactive process viewer on systems where it is installed.

These tools help identify resource-intensive applications while accounting records preserve historical usage data.

Benefits of UNIX Accounting

UNIX accounting offers several advantages:

  • Tracks every user's system activity.

  • Helps investigate security incidents.

  • Monitors CPU and memory usage.

  • Generates reports for administrators.

  • Assists in capacity planning.

  • Detects unusual or suspicious behavior.

  • Supports auditing and compliance requirements.

  • Identifies frequently used applications.

  • Helps enforce resource usage policies.

  • Improves overall system administration.

Security Applications

Accounting records are valuable in security investigations.

For example, if unauthorized software is executed, administrators can determine:

  • Which user executed it.

  • When it was executed.

  • How long it ran.

  • How many system resources it consumed.

  • Whether similar commands were executed previously.

Similarly, repeated failed login attempts recorded in the btmp file may indicate a brute-force attack, allowing administrators to take corrective action.

Limitations of UNIX Accounting

Although accounting is useful, it has some limitations:

  • It records completed processes rather than live activities.

  • Large systems can generate substantial accounting data, requiring regular maintenance.

  • Some records require administrative privileges to access.

  • Improper configuration may lead to incomplete data collection.

  • Accounting supplements but does not replace comprehensive system logging.

Best Practices

To make effective use of UNIX accounting:

  • Enable process accounting on production systems.

  • Regularly review login and command history.

  • Archive old accounting records to conserve disk space.

  • Monitor failed login attempts for security threats.

  • Combine accounting with system logs for thorough auditing.

  • Restrict access to accounting files to authorized administrators.

  • Generate periodic reports to identify usage trends and resource bottlenecks.

Conclusion

UNIX accounting and user activity monitoring provide a comprehensive way to track system usage, user behavior, and resource consumption. By maintaining detailed records of logins, executed commands, and system resources, accounting helps administrators improve security, optimize performance, troubleshoot issues, and ensure accountability in multi-user environments. When used alongside system logs and monitoring tools, UNIX accounting becomes an essential component of effective system administration and security management.