atopacctd - process accounting daemon
atopacctd [-v | topdirectory]
The
atopacctd daemon switches on the process accounting feature in the
kernel and let the process accounting records be written to a file, called the
source file from now. After process accounting is activated, the
atopacctd daemon transfers every process accounting record that is
available in the source file to a shadow file. Client processes (like
atop processes) will read the shadow files instead of the process
accounting source file.
In this way, the
atopacctd daemon operates as a 'layer' between the
process accounting file that is written by the kernel and the shadow
accounting files that are read by
atop processes.
This approach has the following advantages:
- o
- The atopacctd daemon takes care that the source file
is kept to a limited size. As soon as its maximum size is reached, it is
truncated to a size of zero again (this is not noticed by the atop
processes).
- o
- The atopacct daemon takes care that a shadow file is
kept to a limited size. As soon as the current shadow file reaches this
maximum size, the atopacctd daemon creates a new (subsequent)
shadow file. While client processes still have the possibility to read the
previous shadow file(s), the atopacctd daemon continues writing
accounting records to the newest (current) shadow file. For this reason,
the name of a shadow file consists of a 10-digit sequence number followed
by the extension '.paf' (process acounting file). Old shadow files that
are not used by client processes any more, are automatically removed by
the garbage collector in the atopacctd daemon.
- o
- When no client processes are active (any more), all shadow
files will be deleted and no records will be transferred to a shadow file
any more. As soon as at least one client is activate again, the
atopacctd daemon continues writing shadow files.
The directory
/run is used as the default topdirectory. Below this
top-directory, the source file
pacct_source is created to which the
kernel writes the process accounting records.
Furthermore, the subdirectory
pacct_shadow.d is created as a 'container'
for the shadow files. Apart from the shadow files, also the file
current is maintained in this subdirectory, containing the sequence
number of the current (newest) shadow file and the maximum number of records
that will be written in each shadow file.
An alternative topdirectory can be specified as command line argument. When an
alternative topdirectory is defined, also modify the configuration file
/etc/atoprc to inform
atop clients about this alternative
location (see the
atoprc man page). Such alternative topdirectory
should be owned by root and may not be writable for the group or others
(security reasons).
Notice that the kernel suspends writing process accounting records when the free
space of the filesystem on which the process accounting file resides drops
below 2%. Writing is resumed when the free space is 4% or more. These lowwater
and highwater percentages can be configured via the
/proc/sys/kernel/acct pseudo-file.
The
atopacctd daemon suspends transferring process accounting records to
shadow files when the free space of the filesystem on which the process
accounting file resides drops below 5%. Transfer is resumed when the free
space is 5% or more. Log messages are generated via syslog when writing to the
current shadow file is suspended or resumed.
The
-v flag can be used to verify the version of the
atopacctd
daemon.
- /run/pacct_source
- Regular file to which the kernel writes the process
accounting records. This file will be regularly truncated.
- /run/pacct_shadow.d/current
- Regular file containing the sequence number of the current
shadow file and the maximum number of records per shadow file.
- /run/pacct_shadow.d/N.paf
- Regular files containing the process accounting records
that have been copied transparently from the source file (N represents a
10-digit sequence number).
atop(1),
atopsar(1),
atoprc(5),
netatop(4),
netatopd(8)
https://www.atoptool.nl
Gerlof Langeveld (
[email protected])