ACCT(5) File Formats Manual ACCT(5) NAME acct -- execution accounting file SYNOPSIS #include <sys/types.h> #include <sys/acct.h> DESCRIPTION The kernel maintains the following acct information structure for all processes. If a process terminates, and accounting is enabled, the kernel calls the acct(2) function call to prepare and append the record to the ac- counting file. #define AC_COMM_LEN 16 /* * Accounting structure version 3 (current). * The first byte is always zero. * Time units are microseconds. */ struct acctv3 { uint8_t ac_zero; /* zero identifies new version */ uint8_t ac_version; /* record version number */ uint16_t ac_len; /* record length */ char ac_comm[AC_COMM_LEN]; /* command name */ float ac_utime; /* user time */ float ac_stime; /* system time */ float ac_etime; /* elapsed time */ time_t ac_btime; /* starting time */ uid_t ac_uid; /* user id */ gid_t ac_gid; /* group id */ float ac_mem; /* average memory usage */ float ac_io; /* count of IO blocks */ __dev_t ac_tty; /* controlling tty */ uint16_t ac_len2; /* record length */ union { uint32_t ac_align; /* force v1 compatible alignment */ #define AFORK 0x01 /* forked but not exec'ed */ /* ASU is no longer supported */ #define ASU 0x02 /* used super-user permissions */ #define ACOMPAT 0x04 /* used compatibility mode */ #define ACORE 0x08 /* dumped core */ #define AXSIG 0x10 /* killed by a signal */ #define ANVER 0x20 /* new record version */ uint8_t ac_flag; /* accounting flags */ } ac_trailer; #define ac_flagx ac_trailer.ac_flag }; If a terminated process was created by an execve(2), the name of the exe- cuted file (at most ten characters of it) is saved in the field ac_comm and its status is saved by setting one of more of the following flags in ac_flag: AFORK, ACOMPAT, ACORE and ASIG. ASU is no longer supported. ANVER is always set in the above structure. SEE ALSO lastcomm(1), acct(2), execve(2), sa(8) HISTORY A acct file format appeared in Version 7 AT&T UNIX. The current record format was introduced on May 2007. It is backwards compatible with the previous format, which is still documented in <sys/acct.h> and supported by lastcomm(1) and sa(8). FreeBSD 15.1 February 13, 2017 ACCT(5)
NAME | SYNOPSIS | DESCRIPTION | SEE ALSO | HISTORY
Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=acct&sektion=5&manpath=FreeBSD+15.1-RELEASE+and+Ports.quarterly>