rich@jolnet.UUCP (Rich Andrews) (05/12/88)
I have been running accounting here and have yet to see any sort of activity (ps -ef) and yet i know that every time a command is entered it is logged to the appropriate disk file. What is the mechanism involved here and how does it "hide" from the ps -ef output? rich andrews -- ------------------------------------------------------------------------------ Any opinions expressed are my own. Now, for a limited time, they can be yours too, for the incredible price of only $19.95. Simply send $19.95 (in Alterian dollars) to ...killer!jolnet!rich. Or call (312) 301-2100 (data) Rich Andrews
rich@jolnet.UUCP (Rich Andrews) (05/12/88)
I have been running accounting here and have yet to see any sort of activity
(ps -ef) and yet i know that every time a command is entered it is logged to the
appropriate disk file.
What is the mechanism involved here and how does it "hide" from the
ps -ef output?
rich andrews
--
------------------------------------------------------------------------------
Any opinions expressed are my own. Now, for a limited time, they can be yours
too, for the incredible price of only $19.95. Simply send $19.95 (in Alterianfriedl@vsi.UUCP (Stephen J. Friedl) (05/17/88)
In article <555@jolnet.UUCP>, rich@jolnet.UUCP (Rich Andrews) writes: > > I have been running accounting here and have yet to see any sort of activity > (ps -ef) and yet i know that every time a command is entered it is logged > to the appropriate disk file. > > What is the mechanism involved here and how does it "hide" from the > ps -ef output? Accounting is done by the kernel and not by any kind of process that can be seen. Provide a filename with the acct(2) system call and UNIX logs process history into this named file. Because it does not involve some kind of daemon or process (it's done by the kernel) it does not show up under ps. A side note here: if accounting is turned on and dumping history into (say) /usr/adm/pacct, attempts to unmount /usr will be met with 'filesystem busy' even if there are no processes active there. This can be pretty maddening to find out why this is so: look for accounting. -- Steve Friedl V-Systems, Inc. (714) 545-6442 3B2-kind-of-guy friedl@vsi.com {backbones}!vsi.com!friedl attmail!vsi!friedl