ACCT(5)                              BSD                               ACCT(5)



NAME
     acct - execution accounting file

SYNOPSIS
     #include <sys/acct.h>

DESCRIPTION
     The acct(2) system call arranges for entries to be made in an accounting
     file for each process that terminates.  The accounting file is a sequence
     of entries whose layout, as defined by the include file is:

     /*
      * Accounting structures;
      * these use a comp_t type which is a 3 bits base 8
      * exponent, 13 bit fraction ``floating point'' number.
      * Units are 1/AHZ seconds.
      */
     typedef u_short comp_t;

     struct  acct
     {
             short    ac_flag;       /* Accounting flag */
             char     ac_stat;       /* Exit status */
             char     ac_fill1;      /* RESERVED */
             char     ac_sid[36];    /* RESERVED */
             u_long   ac_uid;        /* Accounting user ID */
             u_long   ac_gid;        /* Accounting group ID */
             u_long   ac_oid;        /* Accounting org ID */
             dev_t    ac_tty;        /* control typewriter *//* NOT USED */
             time_t   ac_btime;      /* Beginning time */
             comp_t   ac_utime;      /* Accounting user time */
             comp_t   ac_stime;      /* Accounting system time *//* NOT USED */
             comp_t   ac_etime;      /* Accounting elapsed time */
             short    ac_mem;        /* average memory usage *//* NOT USED */
             comp_t  ac_cio;         /* number of chars IO */  /* NOT USED */
             comp_t   ac_bio;        /* number of disk IO blocks */
             comp_t   ac_net;        /* number of net IO blocks */
             char     ac_exuid[8];   /* RESERVED */
             char     ac_comm[32];   /* Accounting command name */
             comp_t   ac_io;         /* Block IO times AHZ */
             char     ac_fill2[12];  /* RESERVED */
     };

     #define AFORK    0001           /* has executed fork, but no exec */
     #define ASU      0002           /* used super-user privileges *//* NOT USED */
     #define ACOMPAT  0004           /* used compatibility mode */   /* NOT USED */
     #define ACORE    0010           /* dumped core */               /* NOT USED */
     #define AXSIG    0020           /* killed by a signal */        /* NOT USED */

     /*
      * 1/AHZ is the granularity of the data encoded in the various
      * comp_t fields.  This is not necessarily equal to hz.
      */
     #define AHZ 100

     If the process was created by an execve(2), the first 10 characters of
     the filename appear in ac_comm. The accounting flag contains bits
     indicating whether execve(2) was ever accomplished, and whether the
     process ever had super-user privileges.

SEE ALSO

     execve(2), sa(8)