Manual: atopacctd

ATOPACCTD(8)					   System Manager's Manual					ATOPACCTD(8)

NAME
       atopacctd - process accounting daemon

SYNOPSIS
       atopacctd [-v | topdirectory]

DESCRIPTION
       The  atopacctd daemon switches on the process accounting feature in the kernel and let the process accounting records
       be written to a file, called the source file from now.  After process accounting is activated, the  atopacctd  daemon
       transfers  every	 process  accounting record that is available in the source file to a shadow file.  Client processes
       (like atop processes) will read the shadow files instead of the process accounting source file.
       In this way, the atopacctd daemon operates as a 'layer' between the process accounting file that is  written  by	 the
       kernel and the shadow accounting files that are read by atop processes.

       This approach has the following advantages:

       o  The  atopacctd  daemon  takes care that the source file is kept to a limited size.  As soon as its maximum size is
	  reached, it is truncated to a size of zero again (this is not noticed by the atop processes).

       o  The atopacct daemon takes care that a shadow file is kept to a limited size.	As soon as the current	shadow	file
	  reaches  this	 maximum  size, the atopacctd daemon creates a new (subsequent) shadow file.  While client processes
	  still have the possibility to read the previous shadow file(s), the atopacctd daemon continues writing  accounting
	  records  to  the  newest (current) shadow file.  For this reason, the name of a shadow file consists of a 10-digit
	  sequence number followed by the extension '.paf' (process acounting file).  Old shadow files that are not used  by
	  client processes any more, are automatically removed by the garbage collector in the atopacctd daemon.

       o  When	no  client  processes  are active (any more), all shadow files will be deleted and no records will be trans‐
	  ferred to a shadow file any more. As soon as at least one client is activate again, the atopacctd daemon continues
	  writing shadow files.

       The directory /run is used as the default topdirectory.	Below this top-directory, the source  file  pacct_source  is
       created to which the kernel writes the process accounting records.
       Furthermore, the subdirectory pacct_shadow.d is created as a 'container' for the shadow files.  Apart from the shadow
       files,  also  the  file	current	 is  maintained	 in this subdirectory, containing the sequence number of the current
       (newest) shadow file and the maximum number of records that will be written in each shadow file.

       An alternative topdirectory can be specified as command line argument.  When an alternative topdirectory is  defined,
       also modify the configuration file /etc/atoprc to inform atop clients about this alternative location (see the atoprc
       man  page).   Such  alternative	topdirectory should be owned by root and may not be writable for the group or others
       (security reasons).

       Notice that the kernel suspends writing process accounting records when the free space of the filesystem on which the
       process accounting file resides drops below 2%. Writing is resumed when the free space is 4% or more.  These lowwater
       and highwater percentages can be configured via the /proc/sys/kernel/acct pseudo-file.
       The atopacctd daemon suspends transferring process accounting records to shadow files when  the	free  space  of	 the
       filesystem on which the process accounting file resides drops below 5%. Transfer is resumed when the free space is 5%
       or more.	 Log messages are generated via syslog when writing to the current shadow file is suspended or resumed.

       The -v flag can be used to verify the version of the atopacctd daemon.

FILES
       /run/pacct_source
	    Regular file to which the kernel writes the process accounting records.  This file will be regularly truncated.

       /run/pacct_shadow.d/current
	    Regular  file  containing  the  sequence number of the current shadow file and the maximum number of records per
	    shadow file.

       /run/pacct_shadow.d/N.paf
	    Regular files containing the process accounting records that have been copied transparently from the source file
	    (N represents a 10-digit sequence number).

SEE ALSO
       atop(1), atopsar(1), atoprc(5), netatop(4), netatopd(8)
       https://www.atoptool.nl

AUTHOR
       Gerlof Langeveld (gerlof.langeveld@atoptool.nl)

Linux							January 2024						ATOPACCTD(8)