NAME
acct - execution accounting file
SYNOPSIS
#include <sys/acct.h>
DESCRIPTION
Acct(2) causes entries to be made into an accounting file for each process that terminates. The accounting file is a sequence of entries whose layout, as defined by the include file is:
/*
* Accounting structures
*/ typedef unsigned short comp_t; /* "floating pt": 3 bits base 8 exp, 13 bits fraction */ struct acct { char ac_comm[10]; /* Accounting command name */ comp_t ac_utime; /* Accounting user time */ comp_t ac_stime; /* Accounting system time */ comp_t ac_etime; /* Accounting elapsed time */ time_t ac_btime; /* Beginning time */ short ac_uid; /* Accounting user ID */ short ac_gid; /* Accounting group ID */ short ac_mem; /* average memory usage */ comp_t ac_io; /* number of disk IO blocks */ dev_t ac_tty; /* control typewriter */ char ac_flag; /* Accounting flag */ }; extern struct acct acctbuf; extern struct inode *acctp; /* inode of accounting file */ #define AFORK 01 /* has executed fork, but no exec */ #define ASU 02 /* used super-user privileges */
If the process does an exec(2), the first 10 characters of the filename appear in ac_comm. The accounting flag contains bits indicating whether exec(2) was ever accomplished, and whether the process ever had super-user privileges.
SEE ALSO
acct(2), sa(1)