Date: Tue, 25 Jul 1995 09:22:29 -0500 From: Mark Tinguely <tinguely@plains.nodak.edu> To: rgrimes@gndrsh.aac.dev.com Cc: current@freebsd.org Subject: Re: New options for lastcomm(1) Message-ID: <199507251422.JAA10361@plains.nodak.edu>
next in thread | raw e-mail | index | archive | help
> > I use accounting as poor man's (k)trace, for debugging and > > optimization of shell/perl scripts. > > Why do that when we have ktrace in FreeBSD??? I think process accounting is important enough and I needed it enough that I put the original accounting information in the old 386bsd or in one of the first FreeBSD (back in ot-9 when we ran it on an slide rule:) ) I can't remember. process accounting is great for after-the-fact security chases, when the offender is not good at hiding their tracks. it also give a good indication of computer use because it logs things that happen outside login sequence (cron, at, mail, httpd, xterm -u, or rsh to a shell sessions). and it can tell usage of those that are logged on (for example when people around here log in just to "see and be seen"). On other Unix machine, process accounting has been used here to figure out what users do the most. This is can be used to plan how many machine are need and dedicated to what purpose. it is too bad it cannot tell more about the system the momemt it crashed (because process accounting happens only after a process terminates). but it can tell important clues of the few minutes before the crash or hang. I did not see the original mail article on the changes, nor did I see anyone answer the later question on how to install (that is in the FAQ). I still believe that process accounting is important and run it on the computers that are flakey or are used as general access multi-user machines. --mark.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199507251422.JAA10361>