acct for Debian
---------------

The login accounting facilities in 'acct' are not effective on systems like
current Debian versions that use the wtmpdb database instead of utmp(5) format
logs in /var/log/wtmp but are suitable for forensic use on utmp files from
relevant systems.

Hook for consuming process accounting data in other tools
---------------------------------------------------------

The kernel will only populate one BSD-style process acct(5) accounting file at
a time. If this package is collecting the data then other tools wishing to
consume the data should add a hook script under the /etc/acct/hooks.d or
/usr/share/acct/hooks.d directory. The first argument to any such script is
the path to the live accounting file and the second argument is to the recently
rotated file, 'pacct.0'. See bug #922533 for an applicable use case [1].

[1] https://bugs.debian.org/922533

 -- Andrew Bower <andrew@bower.uk>  Sat, 21 Jun 2025 09:07:25 +0100
