NAME

acct − execution accounting file

SYNOPSIS

#include <sys/acct.h>

DESCRIPTION

The acct(2) system call makes entries in an accounting file for each process that terminates. The accounting file is a sequence of entries whose layout, as defined by the include file is:

 ∗ $Header: acct.5 1.2 89/11/06 $
 ∗
 ∗ acct.h
 ∗Accounting records.
 ∗/
 /∗ $Log:acct.5,v $
Revision 1.1  89/11/06  11:06:32  stew
Initial revision
  ∗/
 /∗
 ∗ Merged SysV/4.2 accounting structures;
 ∗ these use a comp_t type which is a 3 bits base 8
 ∗ exponent, 13 bit fraction “floating point” number.
 ∗ The ac_io field is a special case. If 4.2 accounting is
 ∗ enabled, it holds the number of disk IO blocks. If SysV
 ∗ accounting is enabled, it holds the total number of bytes
 ∗ transferred.
 ∗/
typedefu_short comp_t;
 structacct
{
charac_comm[8];/∗ Accounting command name ∗/
comp_tac_utime;/∗ Accounting user time ∗/
comp_tac_stime;/∗ Accounting system time ∗/
comp_tac_etime;/∗ Accounting elapsed time ∗/
time_tac_btime;/∗ Beginning time ∗/
shortac_uid;/∗ Accounting user ID ∗/
shortac_gid;/∗ Accounting group ID ∗/
shortac_mem;/∗ average memory usage ∗/
comp_tac_io;/∗ disk IO blocks or bytes xferred ∗/
dev_tac_tty;/∗ control typewriter ∗/
charac_flag;/∗ Accounting flag ∗/
charac_scgacct;/∗ account identifier ∗/
comp_tac_rw;/∗ number of disk IO blocks ∗/
charac_stat;/∗ Exit status ∗/
};
 #defineAFORK0001 /∗ has executed fork, but no exec ∗/
#defineASU0002 /∗ used super-user privileges ∗/
#defineACORE0010 /∗ dumped core ∗/
#defineAXSIG0020 /∗ killed by a signal ∗/
#defineACCTF0300 /∗ record type: 00 = acct ∗/

If the process does an execve(2), the first 10 characters of the filename appear in ac_comm.  The accounting flag contains bits indicating whether execve(2) was ever accomplished, and whether the process ever had super-user privileges.

SEE ALSO

acct(2), execve(2), sa(8)

7th Edition