1ATOPACCTD(8) System Manager's Manual ATOPACCTD(8)
2
6 atopacctd - process accounting daemon
7
9 atopacctd [-v | topdirectory]
10
12 The atopacctd daemon switches on the process accounting feature in the
13 kernel and let the process accounting records be written to a file,
14 called the source file from now. After process accounting is acti‐
15 vated, the atopacctd daemon transfers every process accounting record
16 that is available in the source file to a shadow file. Client pro‐
17 cesses (like atop processes) will read the shadow files instead of the
18 process accounting source file.
19 In this way, the atopacctd daemon operates as a 'layer' between the
20 process accounting file that is written by the kernel and the shadow
21 accounting files that are read by atop processes.
22 This approach has the following advantages:
24 o The atopacctd daemon takes care that the source file is kept to a
26 limited size. As soon as its maximum size is reached, it is trun‐
27 cated to a size of zero again (this is not noticed by the atop pro‐
28 cesses).
29 o The atopacct daemon takes care that a shadow file is kept to a lim‐
31 ited size. As soon as the current shadow file reaches this maximum
32 size, the atopacctd daemon creates a new (subsequent) shadow file.
33 While client processes still have the possibility to read the previ‐
34 ous shadow file(s), the atopacctd daemon continues writing account‐
35 ing records to the newest (current) shadow file. For this reason,
36 the name of a shadow file consists of a 10-digit sequence number
37 followed by the extension '.paf' (process acounting file). Old
38 shadow files that are not used by client processes any more, are au‐
39 tomatically removed by the garbage collector in the atopacctd dae‐
40 mon.
41 o When no client processes are active (any more), all shadow files
43 will be deleted and no records will be transferred to a shadow file
44 any more. As soon as at least one client is activate again, the
45 atopacctd daemon continues writing shadow files.
46 The directory /var/run is used as the default topdirectory. Below this
48 top-directory, the source file pacct_source is created to which the
49 kernel writes the process accounting records.
50 Furthermore, the subdirectory pacct_shadow.d is created as a 'con‐
51 tainer' for the shadow files. Apart from the shadow files, also the
52 file current is maintained in this subdirectory, containing the se‐
53 quence number of the current (newest) shadow file and the maximum num‐
54 ber of records that will be written in each shadow file.
55 An alternative topdirectory can be specified as command line argument.
57 When an alternative topdirectory is defined, also modify the configura‐
58 tion file /etc/atoprc to inform atop clients about this alternative lo‐
59 cation (see the atoprc man page). Such alternative topdirectory should
60 be owned by root and may not be writable for the group or others (secu‐
61 rity reasons).
62 Notice that the kernel suspends writing process accounting records when
64 the free space of the filesystem on which the process accounting file
65 resides drops below 2%. Writing is resumed when the free space is 4% or
66 more. These lowwater and highwater percentages can be configured via
67 the /proc/sys/kernel/acct pseudo-file.
68 The atopacctd daemon suspends transferring process accounting records
69 to shadow files when the free space of the filesystem on which the
70 process accounting file resides drops below 5%. Transfer is resumed
71 when the free space is 5% or more. Log messages are generated via sys‐
72 log when writing to the current shadow file is suspended or resumed.
73 The -v flag can be used to verify the version of the atopacctd daemon.
75
77 /var/run/pacct_source
78 Regular file to which the kernel writes the process accounting
79 records. This file will be regularly truncated.
80 /var/run/pacct_shadow.d/current
82 Regular file containing the sequence number of the current shadow
83 file and the maximum number of records per shadow file.
84 /var/run/pacct_shadow.d/N.paf
86 Regular files containing the process accounting records that have
87 been copied transparently from the source file (N represents a
88 10-digit sequence number).
89
91 atop(1), atopsar(1), atoprc(5), netatop(4), netatopd(8)
92 https://www.atoptool.nl
93
95 Gerlof Langeveld (gerlof.langeveld@atoptool.nl)
96Linux December 2022 ATOPACCTD(8)