Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages

  
 
  

home | help
ACCT(5)			      File Formats Manual		       ACCT(5)

NAME
       acct -- execution accounting file

SYNOPSIS
       #include	<sys/types.h>
       #include	<sys/acct.h>

DESCRIPTION
       The  kernel  maintains the following acct information structure for all
       processes.  If a	process	terminates, and	 accounting  is	 enabled,  the
       kernel calls the	acct(2)	function call to prepare and append the	record
       to the accounting file.

       #define AC_COMM_LEN 16

       /*
	* Accounting structure version 3 (current).
	* The first byte is always zero.
	* Time units are microseconds.
	*/

       struct acctv3 {
	       uint8_t	ac_zero;	       /* zero identifies new version */
	       uint8_t	ac_version;	       /* record version number	*/
	       uint16_t	ac_len;		       /* record length	*/

	       char	 ac_comm[AC_COMM_LEN]; /* command name */
	       float	 ac_utime;	       /* user time */
	       float	 ac_stime;	       /* system time */
	       float	 ac_etime;	       /* elapsed time */
	       time_t	 ac_btime;	       /* starting time	*/
	       uid_t	 ac_uid;	       /* user id */
	       gid_t	 ac_gid;	       /* group	id */
	       float	 ac_mem;	       /* average memory usage */
	       float	 ac_io;		       /* count	of IO blocks */
	       __dev_t	 ac_tty;	       /* controlling tty */

	       uint16_t	ac_len2;	       /* record length	*/
	       union {
		       uint32_t	 ac_align;     /* force	v1 compatible alignment	*/

       #define AFORK   0x01		       /* forked but not exec'ed */
       /* ASU is no longer supported */
       #define ASU     0x02		       /* used super-user permissions */
       #define ACOMPAT 0x04		       /* used compatibility mode */
       #define ACORE   0x08		       /* dumped core */
       #define AXSIG   0x10		       /* killed by a signal */
       #define ANVER   0x20		       /* new record version */

		       uint8_t	ac_flag;       /* accounting flags */
	       } ac_trailer;

       #define ac_flagx	ac_trailer.ac_flag
       };

       If  a  terminated  process was created by an execve(2), the name	of the
       executed	file (at most ten characters of	it)  is	 saved	in  the	 field
       ac_comm and its status is saved by setting one of more of the following
       flags  in  ac_flag:  AFORK,  ACOMPAT, ACORE and ASIG.  ASU is no	longer
       supported.  ANVER is always set in the above structure.

SEE ALSO
       lastcomm(1), acct(2), execve(2),	sa(8)

HISTORY
       A acct file format appeared in Version 7	AT&T UNIX.  The	current	record
       format was introduced on	May 2007.  It is backwards compatible with the
       previous	format,	which is still documented  in  <sys/acct.h>  and  sup-
       ported by lastcomm(1) and sa(8).

FreeBSD	14.3		       February	13, 2017		       ACCT(5)

Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=acct&sektion=5&manpath=FreeBSD+14.3-RELEASE+and+Ports>

home | help