ACCT

Section: File Formats (5)
Index Return to Main Contents
 

NAME

acct - execution accounting file  

SYNOPSIS

#include <sys/acct.h>  

DESCRIPTION

Acct(2) causes entries to be made into an accounting file for each process that terminates. The accounting file is a sequence of entries whose layout, as defined by the include file is:


/* Copyright (C) 1996-2024 Free Software Foundation, Inc.
   This file is part of the GNU C Library.

   The GNU C Library is free software; you can redistribute it and/or
   modify it under the terms of the GNU Lesser General Public
   License as published by the Free Software Foundation; either
   version 2.1 of the License, or (at your option) any later version.

   The GNU C Library is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
   Lesser General Public License for more details.

   You should have received a copy of the GNU Lesser General Public
   License along with the GNU C Library; if not, see
   <https://www.gnu.org/licenses/>.  */

#ifndef _SYS_ACCT_H
#define _SYS_ACCT_H          1

#include <sys/types.h>
#include <stdint.h>
#include <bits/endian.h>
#include <bits/types/time_t.h>

__BEGIN_DECLS

#define ACCT_COMM 16

/*
  comp_t is a 16-bit "floating" point number with a 3-bit base 8
  exponent and a 13-bit fraction. See linux/kernel/acct.c for the
  specific encoding system used.
*/

typedef uint16_t comp_t;

struct acct
{
  char ac_flag;              /* Flags.  */
  uint16_t ac_uid;           /* Real user ID.  */
  uint16_t ac_gid;           /* Real group ID.  */
  uint16_t ac_tty;           /* Controlling terminal.  */
  uint32_t ac_btime;         /* Beginning time.  */
  comp_t ac_utime;           /* User time.  */
  comp_t ac_stime;           /* System time.  */
  comp_t ac_etime;           /* Elapsed time.  */
  comp_t ac_mem;             /* Average memory usage.  */
  comp_t ac_io;              /* Chars transferred.  */
  comp_t ac_rw;              /* Blocks read or written.  */
  comp_t ac_minflt;          /* Minor pagefaults.  */
  comp_t ac_majflt;          /* Major pagefaults.  */
  comp_t ac_swaps;           /* Number of swaps.  */
  uint32_t ac_exitcode;      /* Process exitcode.  */
  char ac_comm[ACCT_COMM+1]; /* Command name.  */
  char ac_pad[10];           /* Padding bytes.  */
};


struct acct_v3
{
  char ac_flag;              /* Flags */
  char ac_version;           /* Always set to ACCT_VERSION */
  uint16_t ac_tty;           /* Control Terminal */
  uint32_t ac_exitcode;      /* Exitcode */
  uint32_t ac_uid;           /* Real User ID */
  uint32_t ac_gid;           /* Real Group ID */
  uint32_t ac_pid;           /* Process ID */
  uint32_t ac_ppid;          /* Parent Process ID */
  uint32_t ac_btime;         /* Process Creation Time */
  float ac_etime;            /* Elapsed Time */
  comp_t ac_utime;           /* User Time */
  comp_t ac_stime;           /* System Time */
  comp_t ac_mem;             /* Average Memory Usage */
  comp_t ac_io;              /* Chars Transferred */
  comp_t ac_rw;              /* Blocks Read or Written */
  comp_t ac_minflt;          /* Minor Pagefaults */
  comp_t ac_majflt;          /* Major Pagefaults */
  comp_t ac_swaps;           /* Number of Swaps */
  char ac_comm[ACCT_COMM];   /* Command Name */
};


enum
  {
    AFORK = 0x01,            /* Has executed fork, but no exec.  */
    ASU = 0x02,              /* Used super-user privileges.  */
    ACORE = 0x08,            /* Dumped core.  */
    AXSIG = 0x10,            /* Killed by a signal.  */
    AGROUP = 0x20            /* Was the last task of the process
                                (task group).  */
  };

#if __BYTE_ORDER == __BIG_ENDIAN
# define ACCT_BYTEORDER 0x80 /* Accounting file is big endian.  */
#else
# define ACCT_BYTEORDER 0x00 /* Accounting file is little endian.  */
#endif

#define AHZ     100


/* Switch process accounting on and off.  */
extern int acct (const char *__filename) __THROW;

__END_DECLS

#endif  /* sys/acct.h */

If the process does an exec(2), the first 10 characters of the filename appear in ac_comm. The accounting flag contains bits indicating whether exec(2) was ever accomplished, and whether the process ever had super-user privileges.  

SEE ALSO

acct(2), sa(1)


 

Index

NAME
SYNOPSIS
DESCRIPTION
SEE ALSO

This document was created by man2html, using the manual pages.
Time: 10:16:08 GMT, December 28, 2024