diff options
Diffstat (limited to 'man5/acct.5')
| -rw-r--r-- | man5/acct.5 | 161 |
1 files changed, 161 insertions, 0 deletions
diff --git a/man5/acct.5 b/man5/acct.5 new file mode 100644 index 0000000..e1d88d4 --- /dev/null +++ b/man5/acct.5 @@ -0,0 +1,161 @@ +.\" Copyright (C) 2008, Michael Kerrisk <mtk.manpages@gmail.com> +.\" +.\" SPDX-License-Identifier: Linux-man-pages-copyleft +.\" +.TH acct 5 2023-05-03 "Linux man-pages 6.05.01" +.SH NAME +acct \- process accounting file +.SH SYNOPSIS +.nf +.B #include <sys/acct.h> +.fi +.SH DESCRIPTION +If the kernel is built with the process accounting option enabled +.RB ( CONFIG_BSD_PROCESS_ACCT ), +then calling +.BR acct (2) +starts process accounting, for example: +.PP +.in +4n +acct("/var/log/pacct"); +.in +.PP +When process accounting is enabled, the kernel writes a record +to the accounting file as each process on the system terminates. +This record contains information about the terminated process, +and is defined in +.I <sys/acct.h> +as follows: +.PP +.in +4n +.EX +#define ACCT_COMM 16 +\& +typedef u_int16_t comp_t; +\& +struct acct { + char ac_flag; /* Accounting flags */ + u_int16_t ac_uid; /* Accounting user ID */ + u_int16_t ac_gid; /* Accounting group ID */ + u_int16_t ac_tty; /* Controlling terminal */ + u_int32_t ac_btime; /* Process creation time + (seconds since the Epoch) */ + comp_t ac_utime; /* User CPU time */ + comp_t ac_stime; /* System CPU time */ + comp_t ac_etime; /* Elapsed time */ + comp_t ac_mem; /* Average memory usage (kB) */ + comp_t ac_io; /* Characters transferred (unused) */ + comp_t ac_rw; /* Blocks read or written (unused) */ + comp_t ac_minflt; /* Minor page faults */ + comp_t ac_majflt; /* Major page faults */ + comp_t ac_swaps; /* Number of swaps (unused) */ + u_int32_t ac_exitcode; /* Process termination status + (see wait(2)) */ + char ac_comm[ACCT_COMM+1]; + /* Command name (basename of last + executed command; null\-terminated) */ + char ac_pad[\fIX\fP]; /* padding bytes */ +}; +\& +enum { /* Bits that may be set in ac_flag field */ + AFORK = 0x01, /* Has executed fork, but no exec */ + ASU = 0x02, /* Used superuser privileges */ + ACORE = 0x08, /* Dumped core */ + AXSIG = 0x10 /* Killed by a signal */ +}; +.EE +.in +.PP +The +.I comp_t +data type is a floating-point value consisting of a 3-bit, base-8 exponent, +and a 13-bit mantissa. +A value, +.IR c , +of this type can be converted to a (long) integer as follows: +.PP +.nf + v = (c & 0x1fff) << (((c >> 13) & 0x7) * 3); +.fi +.PP +The +.IR ac_utime , +.IR ac_stime , +and +.I ac_etime +fields measure time in "clock ticks"; divide these values by +.I sysconf(_SC_CLK_TCK) +to convert them to seconds. +.SS Version 3 accounting file format +Since Linux 2.6.8, +an optional alternative version of the accounting file can be produced +if the +.B CONFIG_BSD_PROCESS_ACCT_V3 +option is set when building the kernel. +With this option is set, +the records written to the accounting file contain additional fields, +and the width of +.I c_uid +and +.I ac_gid +fields is widened from 16 to 32 bits +(in line with the increased size of UID and GIDs in Linux 2.4 and later). +The records are defined as follows: +.PP +.in +4n +.EX +struct acct_v3 { + char ac_flag; /* Flags */ + char ac_version; /* Always set to ACCT_VERSION (3) */ + u_int16_t ac_tty; /* Controlling terminal */ + u_int32_t ac_exitcode; /* Process termination status */ + u_int32_t ac_uid; /* Real user ID */ + u_int32_t ac_gid; /* Real group ID */ + u_int32_t ac_pid; /* Process ID */ + u_int32_t ac_ppid; /* Parent process ID */ + u_int32_t ac_btime; /* Process creation time */ + float ac_etime; /* Elapsed time */ + comp_t ac_utime; /* User CPU time */ + comp_t ac_stime; /* System time */ + comp_t ac_mem; /* Average memory usage (kB) */ + comp_t ac_io; /* Characters transferred (unused) */ + comp_t ac_rw; /* Blocks read or written + (unused) */ + comp_t ac_minflt; /* Minor page faults */ + comp_t ac_majflt; /* Major page faults */ + comp_t ac_swaps; /* Number of swaps (unused) */ + char ac_comm[ACCT_COMM]; /* Command name */ +}; +.EE +.in +.SH VERSIONS +Although it is present on most systems, it is not standardized, +and the details vary somewhat between systems. +.SH STANDARDS +None. +.SH HISTORY +glibc 2.6. +.PP +Process accounting originated on BSD. +.SH NOTES +Records in the accounting file are ordered by termination time of +the process. +.PP +Up to and including Linux 2.6.9, +a separate accounting record is written for each thread created using +the NPTL threading library; +since Linux 2.6.10, +a single accounting record is written for the entire process +on termination of the last thread in the process. +.PP +The +.I /proc/sys/kernel/acct +file, described in +.BR proc (5), +defines settings that control the behavior of process accounting +when disk space runs low. +.SH SEE ALSO +.BR lastcomm (1), +.BR acct (2), +.BR accton (8), +.BR sa (8) |