acct(5)
NAME
acct − execution accounting file
SYNTAX
#include <sys/acct.h>
DESCRIPTION
The acct system call causes entries to be made into an accounting file for each process that terminates. The accounting file is a sequence of entries whose layout, as defined by the include file is:
/*
* Accounting structures
*/
struct acct
{
char ac_comm[10]; /* Accounting command name */
comp_t ac_utime; /* Accounting user time */
comp_t ac_stime; /* Accounting system time */
comp_t ac_etime; /* Accounting elapsed time */
time_t ac_btime; /* Beginning time */
short ac_uid; /* Accounting user ID */
short ac_gid; /* Accounting group ID */
short ac_mem; /* average memory usage */
comp_t ac_io; /* number of disk IO blocks */
dev_t ac_tty; /* control typewriter */
char ac_flag; /* Accounting flag */
};
extern struct acct acctbuf;
extern struct inode *acctp; /* inode of accounting file */
#define AFORK 01 /* has executed fork, but no exec */
#define ASU 02 /* used superuser privileges */
If the process does an exec, call the first 10 characters of the filename appear in ac_comm. The accounting flag contains bits indicating whether exec was ever accomplished, and whether the process ever had superuser privileges.