summaryrefslogtreecommitdiffstats
path: root/man5/acct.5
diff options
context:
space:
mode:
Diffstat (limited to 'man5/acct.5')
-rw-r--r--man5/acct.5161
1 files changed, 161 insertions, 0 deletions
diff --git a/man5/acct.5 b/man5/acct.5
new file mode 100644
index 0000000..e1d88d4
--- /dev/null
+++ b/man5/acct.5
@@ -0,0 +1,161 @@
+.\" Copyright (C) 2008, Michael Kerrisk <mtk.manpages@gmail.com>
+.\"
+.\" SPDX-License-Identifier: Linux-man-pages-copyleft
+.\"
+.TH acct 5 2023-05-03 "Linux man-pages 6.05.01"
+.SH NAME
+acct \- process accounting file
+.SH SYNOPSIS
+.nf
+.B #include <sys/acct.h>
+.fi
+.SH DESCRIPTION
+If the kernel is built with the process accounting option enabled
+.RB ( CONFIG_BSD_PROCESS_ACCT ),
+then calling
+.BR acct (2)
+starts process accounting, for example:
+.PP
+.in +4n
+acct("/var/log/pacct");
+.in
+.PP
+When process accounting is enabled, the kernel writes a record
+to the accounting file as each process on the system terminates.
+This record contains information about the terminated process,
+and is defined in
+.I <sys/acct.h>
+as follows:
+.PP
+.in +4n
+.EX
+#define ACCT_COMM 16
+\&
+typedef u_int16_t comp_t;
+\&
+struct acct {
+ char ac_flag; /* Accounting flags */
+ u_int16_t ac_uid; /* Accounting user ID */
+ u_int16_t ac_gid; /* Accounting group ID */
+ u_int16_t ac_tty; /* Controlling terminal */
+ u_int32_t ac_btime; /* Process creation time
+ (seconds since the Epoch) */
+ comp_t ac_utime; /* User CPU time */
+ comp_t ac_stime; /* System CPU time */
+ comp_t ac_etime; /* Elapsed time */
+ comp_t ac_mem; /* Average memory usage (kB) */
+ comp_t ac_io; /* Characters transferred (unused) */
+ comp_t ac_rw; /* Blocks read or written (unused) */
+ comp_t ac_minflt; /* Minor page faults */
+ comp_t ac_majflt; /* Major page faults */
+ comp_t ac_swaps; /* Number of swaps (unused) */
+ u_int32_t ac_exitcode; /* Process termination status
+ (see wait(2)) */
+ char ac_comm[ACCT_COMM+1];
+ /* Command name (basename of last
+ executed command; null\-terminated) */
+ char ac_pad[\fIX\fP]; /* padding bytes */
+};
+\&
+enum { /* Bits that may be set in ac_flag field */
+ AFORK = 0x01, /* Has executed fork, but no exec */
+ ASU = 0x02, /* Used superuser privileges */
+ ACORE = 0x08, /* Dumped core */
+ AXSIG = 0x10 /* Killed by a signal */
+};
+.EE
+.in
+.PP
+The
+.I comp_t
+data type is a floating-point value consisting of a 3-bit, base-8 exponent,
+and a 13-bit mantissa.
+A value,
+.IR c ,
+of this type can be converted to a (long) integer as follows:
+.PP
+.nf
+ v = (c & 0x1fff) << (((c >> 13) & 0x7) * 3);
+.fi
+.PP
+The
+.IR ac_utime ,
+.IR ac_stime ,
+and
+.I ac_etime
+fields measure time in "clock ticks"; divide these values by
+.I sysconf(_SC_CLK_TCK)
+to convert them to seconds.
+.SS Version 3 accounting file format
+Since Linux 2.6.8,
+an optional alternative version of the accounting file can be produced
+if the
+.B CONFIG_BSD_PROCESS_ACCT_V3
+option is set when building the kernel.
+With this option is set,
+the records written to the accounting file contain additional fields,
+and the width of
+.I c_uid
+and
+.I ac_gid
+fields is widened from 16 to 32 bits
+(in line with the increased size of UID and GIDs in Linux 2.4 and later).
+The records are defined as follows:
+.PP
+.in +4n
+.EX
+struct acct_v3 {
+ char ac_flag; /* Flags */
+ char ac_version; /* Always set to ACCT_VERSION (3) */
+ u_int16_t ac_tty; /* Controlling terminal */
+ u_int32_t ac_exitcode; /* Process termination status */
+ u_int32_t ac_uid; /* Real user ID */
+ u_int32_t ac_gid; /* Real group ID */
+ u_int32_t ac_pid; /* Process ID */
+ u_int32_t ac_ppid; /* Parent process ID */
+ u_int32_t ac_btime; /* Process creation time */
+ float ac_etime; /* Elapsed time */
+ comp_t ac_utime; /* User CPU time */
+ comp_t ac_stime; /* System time */
+ comp_t ac_mem; /* Average memory usage (kB) */
+ comp_t ac_io; /* Characters transferred (unused) */
+ comp_t ac_rw; /* Blocks read or written
+ (unused) */
+ comp_t ac_minflt; /* Minor page faults */
+ comp_t ac_majflt; /* Major page faults */
+ comp_t ac_swaps; /* Number of swaps (unused) */
+ char ac_comm[ACCT_COMM]; /* Command name */
+};
+.EE
+.in
+.SH VERSIONS
+Although it is present on most systems, it is not standardized,
+and the details vary somewhat between systems.
+.SH STANDARDS
+None.
+.SH HISTORY
+glibc 2.6.
+.PP
+Process accounting originated on BSD.
+.SH NOTES
+Records in the accounting file are ordered by termination time of
+the process.
+.PP
+Up to and including Linux 2.6.9,
+a separate accounting record is written for each thread created using
+the NPTL threading library;
+since Linux 2.6.10,
+a single accounting record is written for the entire process
+on termination of the last thread in the process.
+.PP
+The
+.I /proc/sys/kernel/acct
+file, described in
+.BR proc (5),
+defines settings that control the behavior of process accounting
+when disk space runs low.
+.SH SEE ALSO
+.BR lastcomm (1),
+.BR acct (2),
+.BR accton (8),
+.BR sa (8)