From c4d72ea94bd2a6b3a71f27142f2fc702b61eb348 Mon Sep 17 00:00:00 2001
From: deepend <deepend@tilde.club>
Date: Fri, 13 Feb 2026 18:16:46 +0000
Subject: [PATCH] =?UTF-8?q?Expanded=20docs/accounting.md=20from=20a=20sing?=
 =?UTF-8?q?le=20legacy=20one-liner=20into=20a=20practical=20ops=20referenc?=
 =?UTF-8?q?e=20with=20clearer=20command=20examples=20and=20short=20explana?=
 =?UTF-8?q?tions=20for=20ac,=20who,=20lastlog,=20and=20sa.=20Replaced=20th?=
 =?UTF-8?q?e=20old=20backtick-style=20pattern=20with=20a=20more=20readable?=
 =?UTF-8?q?=20pipeline=20for=20cumulative=20login-time=20reporting,=20plus?=
 =?UTF-8?q?=20caveats=20about=20log=20retention=20and=20rotation=20effects?=
 =?UTF-8?q?.=20Added=20the=20accounting=20guide=20to=20the=20README?=
 =?UTF-8?q?=E2=80=99s=20=E2=80=9CGetting=20started=E2=80=9D=20docs=20list?=
 =?UTF-8?q?=20so=20it=E2=80=99s=20easier=20to=20discover=20alongside=20oth?=
 =?UTF-8?q?er=20server=20operations=20references.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 README.md          |  1 +
 docs/accounting.md | 48 +++++++++++++++++++++++++++++++++++++++++++---
 2 files changed, 46 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 6e67f37..4a187fd 100644
--- a/README.md
+++ b/README.md
@@ -29,6 +29,7 @@ If your goal is to launch your own tilde-style host (or improve an existing one)
 - [Shell server setup notes](docs/shellserver.md)
 - [SSH key onboarding guide](docs/ssh.md)
 - [Current `/etc/skel` permissions reference](docs/etc-skel-permissions.md)
+- [User and session accounting quick reference](docs/accounting.md)
 
 These documents are focused on practical operations, onboarding, and adding community functionality in safe increments.
 
diff --git a/docs/accounting.md b/docs/accounting.md
index defb715..9a7381b 100644
--- a/docs/accounting.md
+++ b/docs/accounting.md
@@ -1,7 +1,49 @@
 # Accounting
 
-See who has been logged in the longest:
+This page collects simple command-line checks for understanding shell usage on a multi-user host.
 
+## Longest cumulative login time (per user)
+
+The historical one-liner below is still useful, but this version is easier to read and less dependent on shell backticks:
+
+```bash
+users | tr ' ' '\n' | sort -u | while read -r user; do
+  ac "$user" | awk -v u="$user" '{print $1, u}'
+done | sort -n
 ```
-for a in `users`; do echo `ac $a` $a; done|sort|uniq|cut -d' ' -f2,3|sort -n
-```
\ No newline at end of file
+
+### Notes
+
+- `ac` reads connection accounting data (typically from `/var/log/wtmp`).
+- Results are cumulative and depend on log retention.
+- On some systems, log rotation or reboots can make totals look lower than expected.
+
+## Who is currently online
+
+```bash
+who
+```
+
+If you only need usernames:
+
+```bash
+who | awk '{print $1}' | sort -u
+```
+
+## Most recent login for each user
+
+```bash
+lastlog
+```
+
+This is useful for finding dormant accounts and checking recent activity.
+
+## Total command usage summary (process accounting)
+
+If process accounting is enabled, you can summarize command usage:
+
+```bash
+sa
+```
+
+Not all systems enable this by default; if `sa` has no data, verify process accounting configuration first.