ACCT(5)

NAME
acct - execution accounting file

SYNOPSIS
#include <sys/acct.h>

DESCRIPTION
The acct(2) system call makes entries in an accounting file for each process that terminates. The accounting file is a sequence of entries whose layout, as defined by the include file is:

/*
 * acct.h
 *	Accounting records.
 */
/*
 * Merged SysV/4.2 accounting structures;
 * these use a comp_t type which is a 3 bits base 8
 * exponent, 13 bit fraction ``floating point'' number.
 * The ac_io field is a special case. If 4.2 accounting is
 * enabled, it holds the number of disk IO blocks. If SysV
 * accounting is enabled, it holds the total number of bytes
 * transferred.
 */
typedef	u_short comp_t;
struct	acct
{
	char	ac_comm[8];		/* Accounting command name */
	comp_t	ac_utime;		/* Accounting user time */
	comp_t	ac_stime;		/* Accounting system time */
	comp_t	ac_etime;		/* Accounting elapsed time */
	time_t	ac_btime;		/* Beginning time */
	short	ac_uid;			/* Accounting user ID */
	short	ac_gid;			/* Accounting group ID */
	short	ac_mem;			/* average memory usage */
	comp_t	ac_io;			/* disk IO blocks or bytes xferred */
	dev_t	ac_tty;			/* control typewriter */
	char	ac_flag;		/* Accounting flag */
	char	ac_scgacct;		/* account identifier */
	comp_t	ac_rw;			/* number of disk IO blocks */
	char	ac_stat;		/* Exit status */
};
#define	AFORK	0001		/* has executed fork, but no exec */
#define	ASU	0002		/* used super-user privileges */
#define	ACORE	0010		/* dumped core */
#define	AXSIG	0020		/* killed by a signal */
#define	ACCTF	0300		/* record type: 00 = acct */

If the process does an execve(2), the first 8 characters of the filename appear in ac_comm. The accounting flag contains bits indicating whether execve(2) was ever accomplished, and whether the process ever had super-user privileges.

SEE ALSO
acct(2), execve(2), sa(8)