background (hidden) processes

[Stephen J. Friedl]

In article <555 at jolnet.UUCP>, rich at jolnet.UUCP (Rich Andrews) writes:
> 
> I have been running accounting here and have yet to see any sort of activity
> (ps -ef) and yet i know that every time a command is entered it is logged
> to the appropriate disk file.  
> 
> 	What is the mechanism involved here and how does it "hide" from the 
> ps -ef output?

Accounting is done by the kernel and not by any kind of process
that can be seen.  Provide a filename with the acct(2) system
call and UNIX logs process history into this named file.  Because
it does not involve some kind of daemon or process (it's done by
the kernel) it does not show up under ps.

A side note here: if accounting is turned on and dumping history
into (say) /usr/adm/pacct, attempts to unmount /usr will be met
with 'filesystem busy' even if there are no processes active
there.  This can be pretty maddening to find out why this is so:
look for accounting.

-- 
Steve Friedl    V-Systems, Inc. (714) 545-6442    3B2-kind-of-guy
friedl at vsi.com    {backbones}!vsi.com!friedl   attmail!vsi!friedl