Linux Kernel Process Accounting Offers Robust Auditing Capabilities
The Linux kernel's process accounting feature, enabled via the 'accton' command, provides detailed logging of process termination for system auditing and security monitoring.
Linux systems possess a powerful, yet often overlooked, built-in feature for auditing system activity: process accounting. Enabled through the accton command, this kernel-level functionality logs comprehensive details about each process upon its termination to a dedicated binary file, typically located at /var/log/account/pacct. This data can then be parsed by utilities like lastcomm and sa to offer deep insights into command history, resource utilization, and user activity, serving as a valuable supplement to standard command history logs.
While not enabled by default, process accounting introduces minimal overhead, with memory and CPU usage generally unaffected. The primary consideration is disk space, with a moderately busy system consuming around 50 MB per day. Installation is straightforward on most distributions; for Debian-based systems, the acct package can be installed via apt install acct. Enabling and starting the service is typically achieved with systemctl enable --now acct, after which the kernel will begin populating the accounting log file.
The logs themselves are stored in a binary format, necessitating specific tools for interpretation. The lastcomm command is instrumental in rendering this data into a human-readable format, displaying information such as the process name, execution flags (indicating superuser status, forked processes, core dumps, or signal termination), the user who initiated the process, CPU execution time, and the start timestamp. This output can be further refined based on command-line arguments, providing a detailed audit trail.
Beyond basic viewing, the sa command offers powerful summarization capabilities. For instance, sa -c can provide a breakdown of CPU time consumed by different processes, offering a high-level overview of system resource allocation. This can be particularly useful for identifying performance bottlenecks or unusual resource consumption patterns.
Process accounting logs are not generated via syslog, but they can be integrated with centralized logging solutions and Security Information and Event Management (SIEM) systems. Tools like syslog-ng offer specific processors, such as s_pacct, to ingest and forward these accounting logs, enabling unified monitoring and analysis across an infrastructure.
For users operating within containerized environments like Proxmox, process accounting requires privileged containers to function. However, even if not enabled within the container, the host system can log container processes, which can be advantageous for centralizing logs and preventing tampering from within the container itself.
In conclusion, Linux kernel process accounting is a robust and readily available feature for enhancing system auditing. While it doesn't capture command-line arguments, it provides a valuable layer of detail that complements other logging mechanisms, capturing processes that might otherwise go unrecorded. Its ease of implementation and the depth of information it provides make it a highly recommended tool for system administrators and security professionals alike.