How to Monitor Linux User Activity with psacct and acct Tools

Managing a Linux server with multiple users can be challenging. You need to know who’s logged in, what commands they’re running, and how much CPU time they’re using. These questions matter for security and system performance.

I work with a development team where everyone constantly works on our servers. We needed a way to track user activities. That’s when I found psacct and acct tools. These free utilities run in the background and monitor everything users do on your Linux system.

What These Tools Do

The psacct and acct packages are basically the same thing with different names. Red Hat systems like CentOS and Fedora use psacct. Debian systems like Ubuntu use acct. They give you several useful commands to monitor user activities.

• The ac command shows how long users stay logged in.
• The lastcomm command shows every command users executed.
• The sa command gives you summaries of resource usage.

Installing the Tools

Installation is simple and depends on your Linux distribution.

For Ubuntu and Debian systems

sudo apt update
sudo apt install acct

The service starts automatically after installation on these systems.

For CentOS, RHEL, and Fedora systems

sudo yum install psacct

Or on newer systems:

sudo dnf install psacct

On Red Hat systems, you need to start the service manually:

sudo systemctl start psacct
sudo systemctl enable psacct
sudo systemctl status psacct

The system creates a file at /var/account/pacct where it stores all monitoring data.

Checking User Login Times

Want to know the total hours users spent on your system? Just type:

ac

You’ll see output like total 11299.15 showing combined connection hours for all users.

To see individual user times, add the -p flag:

ac -p

This breaks down hours by each user. You might see that root logged in much more than others. This could be normal or might mean you should delegate work to regular users.

For daily patterns, use:

ac -d

This shows which days had the most activity. Unusual spikes might indicate problems worth investigating.

To check on one specific user:

ac ravi

This shows total hours for user “ravi”. Add -d to see it broken down by day.

Finding What Commands Users Ran

The sa command shows a summary of executed commands:

sa

The output shows CPU time, memory usage, and command names. An asterisk next to a command means someone ran it with sudo privileges.

To see what each user did:

sa -u

To find which commands use the most resources:

sa -c

This instantly shows which commands are eating up system resources.

Tracking Command History

The lastcomm command shows the complete history of executed commands. To see everything:

lastcomm

To see what user “ravi” did:

lastcomm ravi

To see who ran a specific command like ls:

lastcomm ls

This is really useful for security checks. For example, to see who looked at password files:

lastcomm cat | grep -i "shadow\|passwd"

You can limit output to recent commands:

lastcomm tecmint | head -n 20

Real World Examples

Let me share situations where these tools helped us.

• Our server started running slow one afternoon. I ran sa -c and found one developer’s script was eating 75% of the CPU. We optimized the script and everything went back to normal.
• For security, we once noticed suspicious file access. Using lastcomm, we traced all commands during that time and found the problem before any damage happened.
• If you run shared hosting, ac -p gives you exact numbers for billing customers fairly based on their server usage time.

Managing Log Files

These tools create log files that grow over time. On busy servers, files can get large and use lots of disk space.

The main log file is at /var/account/pacct. Set up log rotation by creating a file at /etc/logrotate.d/psacct:

/var/account/pacct {
    monthly
    rotate 12
    compress
    notifempty
    create 0600 root root
}

This rotates logs monthly, keeps 12 months of history, and compresses old logs.

Useful Command Combinations

Mix commands to get specific information you need:

• See commands from a user today:

  lastcomm username | head -n 50

• Find top resource-heavy commands:

  sa -c | head -n 20

• Check login patterns for last month:

  ac -d | tail -n 31

Security Tips

The data these tools collect is sensitive. Protect log files with strict permissions:

chmod 0600 /var/account/pacct

Only system administrators should read these files. Check logs regularly to spot weird patterns. I review our logs every few days.

You can write simple scripts to flag suspicious activities automatically. For example, send email alerts if someone logs in at 3 AM.

Understanding the Output

When you see 0.04re in sa output, that’s real time in minutes. The 0.04cp shows CPU time used. Numbers like 6546k show memory usage in kilobytes.

Controlling Monitoring

Sometimes you might want to pause monitoring during maintenance:

sudo accton off

To start it again:

sudo accton on

Why Use These Tools

Every Linux server with multiple users needs monitoring. It helps with security investigations, performance troubleshooting, and compliance requirements.

The tools are free, built into Linux, and need minimal setup. They don’t slow down your server. The overhead is tiny even on busy systems.

With proper log rotation, disk space isn’t a problem. Even on our busiest servers, logs only use a few hundred megabytes.

Getting More Help

For complete information, check the manual pages:

• man ac
• man sa
• man lastcomm
• man accton

Conclusion

I’ve used psacct and acct tools for years. They’re simple, reliable, and incredibly useful. Every time we have a problem, these logs help us understand what happened.

Start using them on your servers today. The setup takes five minutes. After that, tools work automatically in the background. You check data whenever you need it.

Remember to review logs regularly. Don’t wait for a crisis. Make it a habit to check user activity once a week. You’ll catch problems before they become serious.

These tools give you visibility and accountability. They protect your system and help you manage resources better. For any multi-user Linux environment, process accounting should be standard practice.