ACCT(5) | File Formats Manual | ACCT(5)

# NAME

`acct` —
execution accounting file

# SYNOPSIS

`#include <sys/acct.h>`

# DESCRIPTION

The kernel maintains the following acct information structure for all processes. If a process terminates, and accounting is enabled, the kernel calls the acct_process(9) function call to prepare and append the record to the accounting file.

    /*
     * Accounting structures; these use a comp_t type which is a 3 bits base 8
     * exponent, 13 bit fraction ``floating point'' number.  Units are 1/AHZ
     * seconds.
     */
    typedef uint16_t comp_t;

    struct acct {
    	char	  ac_comm[16];	/* name of command */
    	comp_t	  ac_utime;	/* user time */
    	comp_t	  ac_stime;	/* system time */
    	comp_t	  ac_etime;	/* elapsed time */
    	time_t	  ac_btime;	/* starting time */
    	uid_t	  ac_uid;	/* user id */
    	gid_t	  ac_gid;	/* group id */
    	uint16_t  ac_mem;	/* memory usage average */
    	comp_t	  ac_io;	/* count of IO blocks */
    	dev_t	  ac_tty;	/* controlling tty */
    #define	AFORK	0x01		/* fork'd but not exec'd */
    #define	ASU	0x02		/* used super-user permissions */
    #define	ACOMPAT	0x04		/* used compatibility mode */
    #define	ACORE	0x08		/* dumped core */
    #define	AXSIG	0x10		/* killed by a signal */
    	uint8_t	  ac_flag;	/* accounting flags */
    };

    /*
     * 1/AHZ is the granularity of the data encoded in the comp_t fields.
     * This is not necessarily equal to hz.
     */
    #define	AHZ	64

    #ifdef _KERNEL
    void   acct_init(void);
    int    acct_process(struct lwp *);
    endif

If a terminated process was created by an execve(2), the name of the executed file (at most ten characters of it) is saved in the field ac_comm and its status is saved by setting one of more of the following flags in ac_flag: `AFORK`, `ACORE`, and `AXSIG`.

The `ASU` flag is not recorded anymore because with the switch to kauth(9), the superuser model is optional and passing the affected process to every authorization call in order to record `ASU` in p_acflag, would require many source changes and would not reflect reality because the authorization decision might not have been done based on the secmodel_suser(9) model.

The `ACOMPAT` flag was never recorded in NetBSD; we could consider setting when the a process is running under emulation, but this is not currently done.

Both the `ASU` and the `ACOMPAT` flags are retained for source compatibility.

# SEE ALSO

lastcomm(1), acct(2), execve(2), accton(8), sa(8), acct_process(9)

# HISTORY

A `acct` file format appeared in Version 7 AT&T UNIX.

August 5, 2024 | NetBSD 9.4