ATOPACCTD(8)

💖 ATOPACCTD — process accounting daemon 💖

ok so bestie, welcome to atopacctd(8) from the System Manager's Manual section 8 (that's the "admin commands" shelf, iykyk). this little daemon is the backstage crew that makes the whole process-accounting show run without anyone in the audience noticing. let's get into it 🫶

---

✨ NAME ✨

atopacctd — process accounting daemon

---

🌸 SYNOPSIS 🌸

atopacctd [-v | topdirectory]

---

🦋 DESCRIPTION 🦋

okay so picture this: the atopacctd daemon flips on the process accounting feature inside the kernel, and it makes the process accounting records get written to a file. from here on out, we're calling that one the source file. once process accounting is live, atopacctd takes every single process accounting record that's sitting there in the source file and transfers it over to a shadow file. then the client processes (things like atop processes) read those shadow files instead of reading the process accounting source file directly.

so basically, atopacctd is operating as a whole 'layer' between the process accounting file that the kernel writes and the shadow accounting files that atop processes read. middle management but make it iconic 💅

this approach has the following advantages:

• the atopacctd daemon takes care that the source file is kept to a limited size. the literal second its maximum size is reached, it gets truncated to a size of zero again (and the atop processes don't even notice — no drama, no cap).
• the atopacct daemon takes care that a shadow file is kept to a limited size. as soon as the current shadow file hits this maximum size, atopacctd creates a new (subsequent) shadow file. while client processes still have the possibility to read the previous shadow file(s), atopacctd keeps writing accounting records to the newest (current) shadow file. that's why the name of a shadow file is a 10-digit sequence number followed by the extension .paf (process acounting file). old shadow files that client processes aren't using any more get automatically removed by the garbage collector inside the atopacctd daemon. spring cleaning behavior, honestly 🧹✨
• when no client processes are active (any more), all shadow files will be deleted and no records will be transferred to a shadow file any more. and the moment at least one client is activate again, atopacctd picks right back up writing shadow files. she's so resilient, we love her 💜

the directory /var/run is used as the default topdirectory. below this top-directory, the source file pacct_source is created, and that's where the kernel writes the process accounting records.

also, the subdirectory pacct_shadow.d gets created as a 'container' for the shadow files. apart from the shadow files, the file current is also maintained in this subdirectory, and it contains the sequence number of the current (newest) shadow file plus the maximum number of records that will be written in each shadow file.

you can specify an alternative topdirectory as a command line argument. when an alternative topdirectory is defined, you also need to modify the configuration file /etc/atoprc to inform atop clients about this alternative location (go check the atoprc man page, bestie). such alternative topdirectory should be owned by root and may not be writable for the group or others — security reasons, periodt. 🔒

heads up: notice that the kernel suspends writing process accounting records when the free space of the filesystem on which the process accounting file resides drops below 2%. writing is resumed when the free space is 4% or more. these lowwater and highwater percentages can be configured via the /proc/sys/kernel/acct pseudo-file.

and the atopacctd daemon itself suspends transferring process accounting records to shadow files when the free space of the filesystem on which the process accounting file resides drops below 5%. transfer is resumed when the free space is 5% or more. log messages get generated via syslog when writing to the current shadow file is suspended or resumed. 📢

the -v flag can be used to verify the version of the atopacctd daemon. cute and useful.

---

🎀 FILES 🎀

• /var/run/pacct_source — regular file to which the kernel writes the process accounting records. this file will be regularly truncated. (she reinvents herself constantly 😌)
• /var/run/pacct_shadow.d/current — regular file containing the sequence number of the current shadow file and the maximum number of records per shadow file.
• /var/run/pacct_shadow.d/N.paf — regular files containing the process accounting records that have been copied transparently from the source file (N represents a 10-digit sequence number).

---

🌈 SEE ALSO 🌈

atop(1), atopsar(1), atoprc(5), netatop(4), netatopd(8)

https://www.atoptool.nl

---

👑 AUTHOR 👑

Gerlof Langeveld (gerlof.langeveld@atoptool.nl) — absolute legend, fr fr 💖

---

and that's the whole vibe! this page came to you from the Linux manual, January 2024, and it's the ATOPACCTD(8) page — go forth and account for your processes, bestie 🦋✨💅