acct for Debian --------------- The login accounting facilities in 'acct' are not effective on systems like current Debian versions that use the wtmpdb database instead of utmp(5) format logs in /var/log/wtmp but are suitable for forensic use on utmp files from relevant systems. Hook for consuming process accounting data in other tools --------------------------------------------------------- The kernel will only populate one BSD-style process acct(5) accounting file at a time. If this package is collecting the data then other tools wishing to consume the data should add a hook script under the /etc/acct/hooks.d or /usr/share/acct/hooks.d directory. The first argument to any such script is the path to the live accounting file and the second argument is to the recently rotated file, 'pacct.0'. See bug #922533 for an applicable use case [1]. [1] https://bugs.debian.org/922533 -- Andrew Bower Sat, 21 Jun 2025 09:07:25 +0100