As cited
Copy frozen at (site build).
research
Linux Kernel Process Accounting
Linux kernel process accounting is a built-in feature that logs process execution details to a binary file when processes terminate, providing visibility into system activity beyond what bash history captures. The article covers installation via the acct package, reading logs with the lastcomm command, forwarding logs to a SIEM via syslog-ng, and analyzing summaries with the sa command. Process accounting adds minimal overhead (approximately 50 MB per day) and works at the kernel level, making tampering from unprivileged containers difficult.
Why it matters: Security teams and system administrators should consider enabling process accounting for forensic visibility and incident response, as it captures all process execution on a system with lower overhead than alternative monitoring tools like eBPF, though it does not log command-line arguments.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
research
Linux Kernel Process Accounting
Linux kernel process accounting is a built-in feature that logs process termination details to a binary file, providing a kernel-level view of executed commands with minimal system overhead. The accton command enables logging to /var/log/account/pacct, and the lastcomm and sa tools allow administrators to read and summarize the collected data, including process name, user, CPU time, and execution timestamps. Process accounting complements bash history by capturing system processes that shell histories would miss, though it does not record command-line arguments.
Why it matters: Incident response teams and security practitioners should enable process accounting to create a tamper-resistant, centralized audit trail of process execution across Linux infrastructure, especially in containerized environments where host-level logging prevents evasion from within containers.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
research
Linux Kernel Process Accounting
Linux kernel process accounting is a built-in feature that logs process termination details to a binary file, providing a kernel-level view of executed commands with minimal system overhead. The accton command enables logging to /var/log/account/pacct, and the lastcomm and sa tools allow administrators to read and summarize the collected data, including process name, user, CPU time, and execution timestamps. Process accounting complements bash history by capturing system processes that shell histories would miss, though it does not record command-line arguments.
Why it matters: Incident response teams and security practitioners should enable process accounting to create a tamper-resistant, centralized audit trail of process execution across Linux infrastructure, especially in containerized environments where host-level logging prevents evasion from within containers.
- Source published
- First seen by Cybersecurity Tracker