---
title: "pacct: Collect process accounting logs on Linux"
url: "https://axoflow.com/docs/axosyslog-core/4.28/chapter-sources/source-pacct/"
last_modified: "2026-09-30T14:50:17+02:00"
---

> For the complete documentation index, see [llms.txt](https://axoflow.com/docs/axosyslog-core/4.28/llms.txt).

# pacct: Collect process accounting logs on Linux

AxoSyslog can collect process accounting logs on Linux systems.Process accounting is the method of recording and summarizing commands executed on Linux, for example, the commands being run, the user who executed the command, CPU time used by the process, exit code, and so on. When process accounting (also called pacct) is enabled on a system, the kernel writes accounting records to the `/var/log/account/pacct` file (might vary between different Linux distributions).

The `pacct()` driver parses the fields of the accounting logs and transforms them into name-value pairs. The fields are defined in the manual page of the accounting log file (`man acct`), AxoSyslog prepends every field with the `.pacct.` prefix. For example, the `ac_uid` field that contains the id of the user who started the process will be available under the `$.pacct.ac_uid` name. These can be used as macros in templates, in filters to select specific messages, and so on.

## Prerequisites

- AxoSyslog version 3.2.0 or later.
- Install the `axosyslog-scl` package on [Debian/Ubuntu](https://axoflow.com/docs/axosyslog-core/4.28/install/debian-ubuntu/index.md). On [RHEL and compatible distributions](https://axoflow.com/docs/axosyslog-core/4.28/install/rhel-fedora-almalinux/index.md), the SCL files are part of the `axosyslog` base package.

  Your configuration must also contain `@include "scl.conf"`, which the default configuration file already does. If the SCL files are missing, AxoSyslog fails to start with an [`unexpected LL_IDENTIFIER` error](https://axoflow.com/docs/axosyslog-core/4.28/chapter-troubleshooting-syslog-ng/unexpected-ll-identifier/index.md).

  ```shell
  @include "scl.conf"
  ```

  The `pacct()` driver is a reusable configuration snippet (SCL). For details on using or writing such configuration snippets, see [Reusing configuration blocks](https://axoflow.com/docs/axosyslog-core/4.28/chapter-configuration-file/large-configs/config-blocks/index.md). You can find its source in [scl/pacct/plugin.conf](https://github.com/axoflow/axosyslog/blob/main/scl/pacct/plugin.conf) on GitHub.
- The AxoSyslog application must be compiled with the `--enable-pacct` option. Execute the `syslog-ng -V` command to check if your binary supports process accounting.
- The `pacctformat` plugin must be loaded. By default, AxoSyslog automatically loads the available modules.
- Process accounting must be running on the host. You can enable it with the `accton` command.

## Configuration

To use the `pacct()` driver, use the following syntax.

```shell
@version: 4.28
@include "scl.conf"
source s_pacct { pacct(); };
...
log { source(s_pacct); destination(...); };
```

## pacct() source options

The `pacct()` driver has the following options:

## file()

|  |  |
| --- | --- |
| Type: | filename with path |
| Default: | /var/log/account/pacct |

*Description:* The file where the process accounting logs are stored — AxoSyslog reads accounting messages from this file.

## follow-freq()

|  |  |
| --- | --- |
| Type: | number |
| Default: | 1 |

*Description:* Indicates that the source should be checked periodically. This is useful for files which always indicate readability, even though no new lines were appended. If this value is higher than zero, AxoSyslog will not attempt to use `poll()` on the file, but checks whether the file changed every time the `follow-freq()` interval (in seconds) has elapsed. Floating-point numbers (for example, `1.5`) can be used as well.

## hook-commands()

*Description:* This option makes it possible to execute external programs when the relevant driver is initialized or torn down. The `hook-commands()` can be used with all source and destination drivers with the exception of the `usertty()` and `internal()` drivers.

> **Note:**
> The AxoSyslog application must be able to start and restart the external program, and have the necessary permissions to do so. For example, if your host is running AppArmor or SELinux, you might have to modify your AppArmor or SELinux configuration to enable AxoSyslog to execute external applications.

### Using `hook-commands()` when AxoSyslog starts or stops

To execute an external program when AxoSyslog starts or stops, use the following options:

#### `startup()`

| Type: | string |
| --- | --- |
| Default: | N/A |

*Description:* Defines the external program that is executed as AxoSyslog starts.

#### `shutdown()`

| Type: | string |
| --- | --- |
| Default: | N/A |

*Description:* Defines the external program that is executed as AxoSyslog stops.

### Using the hook-commands() when AxoSyslog reloads

To execute an external program when the AxoSyslog configuration is initiated or torn down, for example, on startup/shutdown or during a AxoSyslog reload, use the following options:

#### `setup()`

| Type: | string |
| --- | --- |
| Default: | N/A |

*Description:* Defines an external program that is executed when the AxoSyslog configuration is initiated, for example, on startup or during a AxoSyslog reload.

#### `teardown()`

| Type: | string |
| --- | --- |
| Default: | N/A |

*Description:* Defines an external program that is executed when the AxoSyslog configuration is stopped or torn down, for example, on shutdown or during a AxoSyslog reload.

### Example: Using hook-commands() with a network source

In the following example, the `hook-commands()` is used with the `network()` driver and it opens an [iptables](https://en.wikipedia.org/wiki/Iptables "https://en.wikipedia.org/wiki/Iptables") port automatically as AxoSyslog is started/stopped.

The assumption in this example is that the `LOGCHAIN` chain is part of a larger ruleset that routes traffic to it. Whenever the AxoSyslog created rule is there, packets can flow, otherwise the port is closed.

```shell
source {
    network(transport(udp)
    hook-commands(
          startup("iptables -I LOGCHAIN 1 -p udp --dport 514 -j ACCEPT")
          shutdown("iptables -D LOGCHAIN 1")
        )
     );
};
```

Last modified September 30, 2026: [Fold small options pages into the main source page (3b62180c)](https://github.com/axoflow/axosyslog-core-docs/commit/3b62180c24b54091714b1e47056ce1ff25020ad7)