System Accounting Enabling
¬

(This article comes from the Staying Secure by Marc Majka from 
NeXT Software Inc.)

     Enable login and process auditing.

     Login and process accounting add to security by allowing you to 
     detect and trace unauthorized activities on your computer. The 
     presence of an accounting system can act as a deterrent as well.

     To enable login accounting, create a file named /usr/adm/wtmp. 
     Then, use the last and ac commands to display login reports and 
     summaries.

     To enable process accounting, create an accounting file with the 
      command:

  touch /usr/adm/acct

     Then, start the accounting program accton during startup with the 
     command:

  /usr/etc/accton /usr/adm/acct

     You can then use the lastcomm and sa commands to print process 
     reports and summaries.

     To accomplish this all automatically, you can add something like 
     the following lines to the system startup file, /etc/rc.local:

  if [ -f /usr/etc/accton -a -f /usr/adm/acct ]; then
  /usr/etc/accton /usr/adm/acct
  (echo " accounting") > /dev/console
  fi

      ¬