Observing User activity with “psacct”

[root@station1 Downloads]# rpm -qa *psacct*
psacct-6.3.2-63.el6.x86_64
[root@station1 Downloads]# service psacct start
Starting process accounting:                               [  OK  ]
[root@station1 Downloads]# ac -p
    root                                 8.81
    total        8.81

Above command will give you Times Totals for Users.

Now, to find out which user has executed what command on system,

[root@station1 Downloads]# lastcomm root

Process      Flags    User    Terminal      Time
smbd               F    root     __         0.00 secs Fri Apr 13 19:20
crond             SF    root     __         0.00 secs Fri Apr 13 19:20
sadc              S     root     __         0.00 secs Fri Apr 13 19:20
bash               F    root     pts/3      0.00 secs Fri Apr 13 19:19
ac                      root     pts/3      0.00 secs Fri Apr 13 19:19
service                 root     pts/3      0.01 secs Fri Apr 13 19:19
psacct                  root     pts/3      0.01 secs Fri Apr 13 19:19
touch                   root     pts/3      0.00 secs Fri Apr 13 19:19
accton            S     root     pts/3      0.00 secs Fri Apr 13 19:19
 

Flags:

 

S - executed as super-user

F - executed after  but not following exec

D - terminated with core file

X - terminated with signal SIGTERM
stop the service if you don't want psacct to monitor 
[root@station1 Downloads]# service psacct stop
Shutting down process accounting:                          [  OK  ]