Expanded docs/accounting.md from a single legacy one-liner into a practical ops reference with clearer command examples and short explanations for ac, who, lastlog, and sa.

Replaced the old backtick-style pattern with a more readable pipeline for cumulative login-time reporting, plus caveats about log retention and rotation effects.
Added the accounting guide to the README’s “Getting started” docs list so it’s easier to discover alongside other server operations references.

README.md

@@ -29,6 +29,7 @@ If your goal is to launch your own tilde-style host (or improve an existing one)
 - [Shell server setup notes](docs/shellserver.md)
 - [SSH key onboarding guide](docs/ssh.md)
 - [Current `/etc/skel` permissions reference](docs/etc-skel-permissions.md)
+- [User and session accounting quick reference](docs/accounting.md)
 
 These documents are focused on practical operations, onboarding, and adding community functionality in safe increments.
 

docs/accounting.md

@@ -1,7 +1,49 @@
 # Accounting
 
-See who has been logged in the longest:
+This page collects simple command-line checks for understanding shell usage on a multi-user host.
 
+## Longest cumulative login time (per user)
+
+The historical one-liner below is still useful, but this version is easier to read and less dependent on shell backticks:
+
+```bash
+users | tr ' ' '\n' | sort -u | while read -r user; do
+  ac "$user" | awk -v u="$user" '{print $1, u}'
+done | sort -n
 ```
-for a in `users`; do echo `ac $a` $a; done|sort|uniq|cut -d' ' -f2,3|sort -n
+
+### Notes
+
+- `ac` reads connection accounting data (typically from `/var/log/wtmp`).
+- Results are cumulative and depend on log retention.
+- On some systems, log rotation or reboots can make totals look lower than expected.
+
+## Who is currently online
+
+```bash
+who
 ```
+
+If you only need usernames:
+
+```bash
+who | awk '{print $1}' | sort -u
+```
+
+## Most recent login for each user
+
+```bash
+lastlog
+```
+
+This is useful for finding dormant accounts and checking recent activity.
+
+## Total command usage summary (process accounting)
+
+If process accounting is enabled, you can summarize command usage:
+
+```bash
+sa
+```
+
+Not all systems enable this by default; if `sa` has no data, verify process accounting configuration first.