acct(5)
NAME
acct − execution accounting file
SYNTAX
#include <sys/acct.h>
DESCRIPTION
The acct(2) system call makes entries in an accounting file for each process that terminates. The accounting file is a sequence of entries whose layout, as defined by the include file is:
struct acct
{
char ac_comm[10]; /* Accounting command name */
float ac_utime; /* Accounting user time */
float ac_stime; /* Accounting system time */
float ac_etime; /* Accounting elapsed time */
time_t ac_btime; /* Beginning time */
short ac_uid; /* Accounting user ID */
short ac_gid; /* Accounting group ID */
float ac_mem; /* average memory usage */
float ac_io; /* number of disk IO blocks */
dev_t ac_tty; /* control typewriter */
char ac_flag; /* Accounting flag */
};
#define AFORK 0001 /* has executed fork, but no exec */
#define ASU 0002 /* used super-user privileges */
#define ACOMPAT 0004 /* used compatibility mode */
#define ACORE 0010 /* dumped core */
#define AXSIG 0020 /* killed by a signal */
#ifdef KERNEL
struct acct acctbuf;
struct inode *acctp;
#endif
If the process does an execve(2), the first 10 characters of the filename appear in ac_comm. The accounting flag contains bits indicating whether execve(2) was ever accomplished, and whether the process ever had super-user privileges.