1.9 KiB
Login and process accounting
Accounting is useful for understanding use and investigating a problem. It is not a reliable count of people and it is not proof of what someone intended. Tell members what you retain and restrict access to logs containing addresses and commands.
Current sessions
who
w
loginctl list-sessions
These commands answer different questions. A persistent tmux session, a user service, and a current terminal login are not the same thing. Some terminal programs also update traditional login records differently.
Login history
On systems with traditional wtmp records:
last
ac -p
ac -p summarizes the retained connection records for all recorded users.
Do not start with users if the goal is to count everybody: that limits the
input to people logged in at the time you run the command. Rotated or missing
records change the totals, and concurrent sessions are not unique human time.
Check which tools and storage the OS actually uses. Newer Fedora installations
may use lastlog2 and different login-record implementations. Use the installed
lastlog2 --help and service documentation rather than assuming the old
lastlog file is populated. A missing record does not establish that an account
has never been used.
Process accounting
The collected host has psacct.service active. On a new Fedora host, install
and enable it only after deciding the logging and retention policy:
dnf install psacct
systemctl enable --now psacct
sa
sa summarizes completed-process accounting records. It does not replace
systemd resource limits, live process inspection, or application logs. Check
package log rotation so accounting data does not consume the filesystem.
For a service problem, start with that service's journal and resource counters. For a user resource problem, inspect the relevant user slice as described in shell operations.