ACCT
NAME
SYNOPSIS
DESCRIPTION
VERSIONS
CONFORMING TO
NOTES
SEE ALSO
COLOPHON
NAME
acct − process accounting file
SYNOPSIS
#include
DESCRIPTION
If the kernel is built with the process accounting option enabled (CONFIG_BSD_PROCESS_ACCT), then calling acct(2) starts process accounting, for example:
acct(“/var/log/pacct”);
When process accounting is enabled, the kernel writes a record to the accounting file as each process on the system terminates. This record contains information about the terminated process, and is defined in
#define ACCT_COMM 16
typedef u_int16_t comp_t;
struct acct {
char ac_flag; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Accounting flags bodies/ usr/
u_int16_t ac_uid; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Accounting user ID bodies/ usr/
u_int16_t ac_gid; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Accounting group ID bodies/ usr/
u_int16_t ac_tty; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Controlling terminal bodies/ usr/
u_int32_t ac_btime; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Process creation time
(seconds since the Epoch) bodies/ usr/
comp_t ac_utime; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var User CPU time bodies/ usr/
comp_t ac_stime; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var System CPU time bodies/ usr/
comp_t ac_etime; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Elapsed time bodies/ usr/
comp_t ac_mem; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Average memory usage (kB) bodies/ usr/
comp_t ac_io; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Characters transferred (unused) bodies/ usr/
comp_t ac_rw; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Blocks read or written (unused) bodies/ usr/
comp_t ac_minflt; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Minor page faults bodies/ usr/
comp_t ac_majflt; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Major page faults bodies/ usr/
comp_t ac_swaps; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Number of swaps (unused) bodies/ usr/
u_int32_t ac_exitcode; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Process termination status
(see wait(2)) bodies/ usr/
char ac_comm[ACCT_COMM+1];
/bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Command name (basename of last
executed command; null-terminated) bodies/ usr/
char ac_pad[X]; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var padding bytes bodies/ usr/
};
enum { /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Bits that may be set in ac_flag field bodies/ usr/
AFORK = 0x01, /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Has executed fork, but no exec bodies/ usr/
ASU = 0x02, /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Used superuser privileges bodies/ usr/
ACORE = 0x08, /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Dumped core bodies/ usr/
AXSIG = 0x10 /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Killed by a signal bodies/ usr/
};
The comp_t data type is a floating-point value consisting of a 3-bit, base-8 exponent, and a 13-bit mantissa. A value, c, of this type can be converted to a (long) integer as follows:
v = (c & 0x1fff) << (((c >> 13) & 0x7) bodies manpages.csv script_extrae_body.sh script.sh usr 3);
The ac_utime, ac_stime, and ac_etime fields measure time in “clock ticks”; divide these values by sysconf(_SC_CLK_TCK) to convert them to seconds.
Version 3 accounting file format
Since kernel 2.6.8, an optional alternative version of the accounting file can be produced if the CONFIG_BSD_PROCESS_ACCT_V3 option is set when building the kernel. With this option is set, the records written to the accounting file contain additional fields, and the width of c_uid and ac_gid fields is widened from 16 to 32 bits (in line with the increased size of UID and GIDs in Linux 2.4 and later). The records are defined as follows:
struct acct_v3 {
char ac_flag; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Flags bodies/ usr/
char ac_version; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Always set to ACCT_VERSION (3) bodies/ usr/
u_int16_t ac_tty; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Controlling terminal bodies/ usr/
u_int32_t ac_exitcode; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Process termination status bodies/ usr/
u_int32_t ac_uid; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Real user ID bodies/ usr/
u_int32_t ac_gid; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Real group ID bodies/ usr/
u_int32_t ac_pid; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Process ID bodies/ usr/
u_int32_t ac_ppid; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Parent process ID bodies/ usr/
u_int32_t ac_btime; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Process creation time bodies/ usr/
float ac_etime; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Elapsed time bodies/ usr/
comp_t ac_utime; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var User CPU time bodies/ usr/
comp_t ac_stime; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var System time bodies/ usr/
comp_t ac_mem; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Average memory usage (kB) bodies/ usr/
comp_t ac_io; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Characters transferred (unused) bodies/ usr/
comp_t ac_rw; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Blocks read or written
(unused) bodies/ usr/
comp_t ac_minflt; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Minor page faults bodies/ usr/
comp_t ac_majflt; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Major page faults bodies/ usr/
comp_t ac_swaps; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Number of swaps (unused) bodies/ usr/
char ac_comm[ACCT_COMM]; /bin /boot /dead.letter /dev /etc /home /initrd /lib /lib64 /lost+found /media /mnt /opt /proc /release-notes.html /release-notes.txt /root /run /sbin /srv /sys /tmp /usr /var Command name bodies/ usr/
};
VERSIONS
The acct_v3 structure is defined in glibc since version 2.6.
CONFORMING TO
Process accounting originated on BSD. Although it is present on most systems, it is not standardized, and the details vary somewhat between systems.
NOTES
Records in the accounting file are ordered by termination time of the process.
In kernels up to and including 2.6.9, a separate accounting record is written for each thread created using the NPTL threading library; since Linux 2.6.10, a single accounting record is written for the entire process on termination of the last thread in the process.
The /proc/sys/kernel/acct file, described in proc(5), defines settings that control the behavior of process accounting when disk space runs low.
SEE ALSO
lastcomm(1), acct(2), accton(8), sa(8)
COLOPHON
This page is part of release 5.10 of the Linux man-pages project. A description of the project, information about reporting bugs, and the latest version of this page, can be found at https://www.kernel.org/doc/man−pages/.