acct for process accounting

ABOUT process accounting

Process accounting is a security method in which an administrator may keep track of system
resources used and their allocation among users, provide for system monitoring, and minimally
track a user's commands. Process accounting has both positive and negative points.

SPECIFIC EXPLANATION
[text]
acct:

highwater lowwater frequency

If BSD-style process accounting is enabled these values control
its behaviour. If free space on filesystem where the log lives
goes below <lowwater>% accounting suspends. If free space gets
above <highwater>% accounting resumes. <Frequency> determines
how often do we check the amount of free space (value is in
seconds). Default:
4 2 30
That is, suspend accounting if there left <= 2% free; resume it
if we got >=4%; consider information about amount of free space
valid for 30 seconds.
[/text]

SHELL SESSION
[bash]
$pwd
/proc/sys/kernel
$cat acct
4 2 30
$su
Password:
root>echo 5 3 40 ? acct
5 3 40 ? acct
root>cat acct
4 2 30
root>echo 5 3 40 > acct
root>cat acct
5 3 40
root>echo 4 2 30 > acct
root>cat acct
4 2 30
root>

[/bash]

LINK
https://www.kernel.org/doc/Documentation/sysctl/kernel.txt
https://www.freebsd.org/doc/handbook/security-accounting.html