atopacctd

ATOPACCTD(8)                System Manager's Manual               ATOPACCTD(8)



NAME
       atopacctd - process accounting daemon

SYNOPSIS
       atopacctd [-v | topdirectory]

DESCRIPTION
       The atopacctd daemon switches on the process accounting feature in the
       kernel and let the process accounting records be written to a file,
       called the source file from now.  After process accounting is
       activated, the atopacctd daemon transfers every process accounting
       record that is available in the source file to a shadow file.  Client
       processes (like atop processes) will read the shadow files instead of
       the process accounting source file.
       In this way, the atopacctd daemon operates as a 'layer' between the
       process accounting file that is written by the kernel and the shadow
       accounting files that are read by atop processes.

       This approach has the following advantages:

       o  The atopacctd daemon takes care that the source file is kept to a
          limited size.  As soon as its maximum size is reached, it is
          truncated to a size of zero again (this is not noticed by the atop
          processes).

       o  The atopacct daemon takes care that a shadow file is kept to a
          limited size.  As soon as the current shadow file reaches this
          maximum size, the atopacctd daemon creates a new (subsequent) shadow
          file.  While client processes still have the possibility to read the
          previous shadow file(s), the atopacctd daemon continues writing
          accounting records to the newest (current) shadow file.  For this
          reason, the name of a shadow file consists of a 10-digit sequence
          number followed by the extension '.paf' (process acounting file).
          Old shadow files that are not used by client processes any more, are
          automatically removed by the garbage collector in the atopacctd
          daemon.

       o  When no client processes are active (any more), all shadow files
          will be deleted and no records will be transferred to a shadow file
          any more. As soon as at least one client is activate again, the
          atopacctd daemon continues writing shadow files.

       The directory /var/run is used as the default topdirectory.  Below this
       top-directory, the source file pacct_source is created to which the
       kernel writes the process accounting records.
       Furthermore, the subdirectory pacct_shadow.d is created as a
       'container' for the shadow files.  Apart from the shadow files, also
       the file current is maintained in this subdirectory, containing the
       sequence number of the current (newest) shadow file and the maximum
       number of records that will be written in each shadow file.

       An alternative topdirectory can be specified as command line argument.
       When an alternative topdirectory is defined, also modify the
       configuration file /etc/atoprc to inform atop clients about this
       alternative location (see the atoprc man page).  Such alternative
       topdirectory should be owned by root and may not be writable for the
       group or others (security reasons).

       Notice that the kernel suspends writing process accounting records when
       the free space of the filesystem on which the process accounting file
       resides drops below 2%. Writing is resumed when the free space is 4% or
       more.  These lowwater and highwater percentages can be configured via
       the /proc/sys/kernel/acct pseudo-file.
       The atopacctd daemon suspends transferring process accounting records
       to shadow files when the free space of the filesystem on which the
       process accounting file resides drops below 5%. Transfer is resumed
       when the free space is 5% or more.  Log messages are generated via
       syslog when writing to the current shadow file is suspended or resumed.

       The -v flag can be used to verify the version of the atopacctd daemon.

FILES
       /var/run/pacct_source
            Regular file to which the kernel writes the process accounting
            records.  This file will be regularly truncated.

       /var/run/pacct_shadow.d/current
            Regular file containing the sequence number of the current shadow
            file and the maximum number of records per shadow file.

       /var/run/pacct_shadow.d/N.paf
            Regular files containing the process accounting records that have
            been copied transparently from the source file (N represents a
            10-digit sequence number).

SEE ALSO
       atop(1), atopsar(1), atoprc(5), netatop(4), netatopd(8)
       https://www.atoptool.nl

AUTHOR
       Gerlof Langeveld (gerlof.langeveld@atoptool.nl)



Linux                            November 2019                    ATOPACCTD(8)