{ "content": [ { "type": "text", "text": "# acct(5) (man)\n\n**Summary:** acct - process accounting file\n\n## See Also\n\n- lastcomm(1)\n- accton(8)\n- sa(8)\n\n## Section Outline\n\n- **NAME** (2 lines)\n- **SYNOPSIS** (1 lines) — 1 subsections\n - #include (1 lines)\n- **DESCRIPTION** (52 lines) — 1 subsections\n - Version 3 accounting file format (29 lines)\n- **VERSIONS** (2 lines)\n- **CONFORMING TO** (3 lines)\n- **NOTES** (9 lines)\n- **SEE ALSO** (2 lines)\n- **COLOPHON** (7 lines)\n\n## Full Content\n\n### NAME\n\nacct - process accounting file\n\n### SYNOPSIS\n\n#### #include \n\n### DESCRIPTION\n\nIf the kernel is built with the process accounting option enabled (CONFIGBSDPROCESSACCT),\nthen calling acct(2) starts process accounting, for example:\n\nacct(\"/var/log/pacct\");\n\nWhen process accounting is enabled, the kernel writes a record to the accounting file as each\nprocess on the system terminates. This record contains information about the terminated\nprocess, and is defined in as follows:\n\n#define ACCTCOMM 16\n\ntypedef uint16t compt;\n\nstruct acct {\nchar acflag; /* Accounting flags */\nuint16t acuid; /* Accounting user ID */\nuint16t acgid; /* Accounting group ID */\nuint16t actty; /* Controlling terminal */\nuint32t acbtime; /* Process creation time\n(seconds since the Epoch) */\ncompt acutime; /* User CPU time */\ncompt acstime; /* System CPU time */\ncompt acetime; /* Elapsed time */\ncompt acmem; /* Average memory usage (kB) */\ncompt acio; /* Characters transferred (unused) */\ncompt acrw; /* Blocks read or written (unused) */\ncompt acminflt; /* Minor page faults */\ncompt acmajflt; /* Major page faults */\ncompt acswaps; /* Number of swaps (unused) */\nuint32t acexitcode; /* Process termination status\n(see wait(2)) */\nchar accomm[ACCTCOMM+1];\n/* Command name (basename of last\nexecuted command; null-terminated) */\nchar acpad[X]; /* padding bytes */\n};\n\nenum { /* Bits that may be set in acflag field */\nAFORK = 0x01, /* Has executed fork, but no exec */\nASU = 0x02, /* Used superuser privileges */\nACORE = 0x08, /* Dumped core */\nAXSIG = 0x10 /* Killed by a signal */\n};\n\nThe compt data type is a floating-point value consisting of a 3-bit, base-8 exponent, and a\n13-bit mantissa. A value, c, of this type can be converted to a (long) integer as follows:\n\nv = (c & 0x1fff) << (((c >> 13) & 0x7) * 3);\n\nThe acutime, acstime, and acetime fields measure time in \"clock ticks\"; divide these val‐\nues by sysconf(SCCLKTCK) to convert them to seconds.\n\n#### Version 3 accounting file format\n\nSince kernel 2.6.8, an optional alternative version of the accounting file can be produced if\nthe CONFIGBSDPROCESSACCTV3 option is set when building the kernel. With this option is\nset, the records written to the accounting file contain additional fields, and the width of\ncuid and acgid fields is widened from 16 to 32 bits (in line with the increased size of UID\nand GIDs in Linux 2.4 and later). The records are defined as follows:\n\nstruct acctv3 {\nchar acflag; /* Flags */\nchar acversion; /* Always set to ACCTVERSION (3) */\nuint16t actty; /* Controlling terminal */\nuint32t acexitcode; /* Process termination status */\nuint32t acuid; /* Real user ID */\nuint32t acgid; /* Real group ID */\nuint32t acpid; /* Process ID */\nuint32t acppid; /* Parent process ID */\nuint32t acbtime; /* Process creation time */\nfloat acetime; /* Elapsed time */\ncompt acutime; /* User CPU time */\ncompt acstime; /* System time */\ncompt acmem; /* Average memory usage (kB) */\ncompt acio; /* Characters transferred (unused) */\ncompt acrw; /* Blocks read or written\n(unused) */\ncompt acminflt; /* Minor page faults */\ncompt acmajflt; /* Major page faults */\ncompt acswaps; /* Number of swaps (unused) */\nchar accomm[ACCTCOMM]; /* Command name */\n};\n\n### VERSIONS\n\nThe acctv3 structure is defined in glibc since version 2.6.\n\n### CONFORMING TO\n\nProcess accounting originated on BSD. Although it is present on most systems, it is not\nstandardized, and the details vary somewhat between systems.\n\n### NOTES\n\nRecords in the accounting file are ordered by termination time of the process.\n\nIn kernels up to and including 2.6.9, a separate accounting record is written for each thread\ncreated using the NPTL threading library; since Linux 2.6.10, a single accounting record is\nwritten for the entire process on termination of the last thread in the process.\n\nThe /proc/sys/kernel/acct file, described in proc(5), defines settings that control the be‐\nhavior of process accounting when disk space runs low.\n\n### SEE ALSO\n\nlastcomm(1), acct(2), accton(8), sa(8)\n\n### COLOPHON\n\nThis page is part of release 5.10 of the Linux man-pages project. A description of the\nproject, information about reporting bugs, and the latest version of this page, can be found\nat https://www.kernel.org/doc/man-pages/.\n\n\n\nLinux 2017-09-15 ACCT(5)\n\n" } ], "structuredContent": { "command": "acct", "section": "5", "mode": "man", "summary": "acct - process accounting file", "synopsis": "", "flags": [], "examples": [], "see_also": [ { "name": "lastcomm", "section": "1", "url": "https://www.chedong.com/phpMan.php/man/lastcomm/1/json" }, { "name": "accton", "section": "8", "url": "https://www.chedong.com/phpMan.php/man/accton/8/json" }, { "name": "sa", "section": "8", "url": "https://www.chedong.com/phpMan.php/man/sa/8/json" } ], "section_outline": [ { "name": "NAME", "lines": 2, "subsections": [] }, { "name": "SYNOPSIS", "lines": 1, "subsections": [ { "name": "#include ", "lines": 1 } ] }, { "name": "DESCRIPTION", "lines": 52, "subsections": [ { "name": "Version 3 accounting file format", "lines": 29 } ] }, { "name": "VERSIONS", "lines": 2, "subsections": [] }, { "name": "CONFORMING TO", "lines": 3, "subsections": [] }, { "name": "NOTES", "lines": 9, "subsections": [] }, { "name": "SEE ALSO", "lines": 2, "subsections": [] }, { "name": "COLOPHON", "lines": 7, "subsections": [] } ] } }