.\" Copyright (C) 2008, Michael Kerrisk <mtk.manpages@gmail.com>
.\"
+.\" %%%LICENSE_START(VERBATIM)
.\" Permission is granted to make and distribute verbatim copies of this
.\" manual provided the copyright notice and this permission notice are
.\" preserved on all copies.
.\"
.\" Formatted or processed versions of this manual, if unaccompanied by
.\" the source, must acknowledge the copyright and authors of this work.
+.\" %%%LICENSE_END
.\"
-.TH ACCT 5 2008-06-15 "Linux" "Linux Programmer's Manual"
+.TH ACCT 5 2017-09-15 "Linux" "Linux Programmer's Manual"
.SH NAME
acct \- process accounting file
.SH SYNOPSIS
then calling
.BR acct (2)
starts process accounting, for example:
-
+.PP
.in +4n
acct("/var/log/pacct");
.in
-
+.PP
When process accounting is enabled, the kernel writes a record
to the accounting file as each process on the system terminates.
This record contains information about the terminated process,
and is defined in
.I <sys/acct.h>
as follows:
-
+.PP
.in +4n
-.nf
+.EX
#define ACCT_COMM 16
typedef u_int16_t comp_t;
ACORE = 0x08, /* Dumped core */
AXSIG = 0x10 /* Killed by a signal */
};
-.fi
+.EE
.in
.PP
The
A value,
.IR c ,
of this type can be converted to a (long) integer as follows:
+.PP
.nf
-
v = (c & 0x1fff) << (((c >> 13) & 0x7) * 3);
.fi
.PP
fields measure time in "clock ticks"; divide these values by
.I sysconf(_SC_CLK_TCK)
to convert them to seconds.
-.SS Version 3 Accounting File Format
+.SS Version 3 accounting file format
Since kernel 2.6.8,
an optional alternative version of the accounting file can be produced
if the
fields is widened from 16 to 32 bits
(in line with the increased size of UID and GIDs in Linux 2.4 and later).
The records are defined as follows:
-
+.PP
.in +4n
-.nf
+.EX
struct acct_v3 {
char ac_flag; /* Flags */
char ac_version; /* Always set to ACCT_VERSION (3) */
comp_t ac_swaps; /* Number of swaps (unused) */
char ac_comm[ACCT_COMM]; /* Command name */
};
-
-.fi
+.EE
.in
.SH VERSIONS
The
.SH NOTES
Records in the accounting file are ordered by termination time of
the process.
-
+.PP
In kernels up to and including 2.6.9,
a separate accounting record is written for each thread created using
the NPTL threading library;
since Linux 2.6.10,
a single accounting record is written for the entire process
on termination of the last thread in the process.
-
+.PP
The
-.I proc/sys/kernel/acct
+.I /proc/sys/kernel/acct
file, described in
.BR proc (5),
defines settings that control the behavior of process accounting
when disk space runs low.
-.SH "SEE ALSO"
+.SH SEE ALSO
.BR lastcomm (1),
.BR acct (2),
.BR accton (8),