.\" Copyright 1991 The Regents of the University of California.
.\" All rights reserved.
.\"
.\" %sccs.include.redist.roff%
.\"
.\"     @(#)acct.5	6.3 (Berkeley) 04/29/91
.\"
.Dd 
.Dt ACCT 5
.Os
.Sh NAME
.Nm acct
.Nd execution accounting file
.Sh SYNOPSIS
.Fd #include <sys/acct.h>
.Sh DESCRIPTION
The kernel maintains the following
.Fa acct
information structure for all
processes. If a process terminates, and accounting is enabled,
the kernel calls the
.Xr acct 2
function call to prepare and append the record
to the accounting file.
.Bd -literal
/*
 * Accounting structures; these use a comp_t type which is a 3 bits base 8
 * exponent, 13 bit fraction ``floating point'' number.  Units are 1/AHZ
 * seconds.
 */
typedef u_short comp_t;

struct acct {
	char	ac_comm[10];	/* name of command */
	comp_t	ac_utime;	/* user time */
	comp_t	ac_stime;	/* system time */
	comp_t	ac_etime;	/* elapsed time */
	time_t	ac_btime;	/* starting time */
	uid_t	ac_uid;		/* user id */
	gid_t	ac_gid;		/* group id */
	short	ac_mem;		/* memory usage average */
	comp_t	ac_io;		/* count of IO blocks */
	dev_t	ac_tty;		/* controlling tty */
#define	AFORK	0x01		/* forked but not execed */
#define	ASU	0x02		/* used super-user permissions */
#define	ACOMPAT	0x04		/* used compatibility mode */
#define	ACORE	0x08		/* dumped core */
#define	AXSIG	0x10		/* killed by a signal */
	char	ac_flag;	/* accounting flags */
};

/*
 * 1/AHZ is the granularity of the data encoded in the comp_t fields.
 * This is not necessarily equal to hz.
 */
#define	AHZ	64

#ifdef KERNEL
struct vnode	*acctp;
#endif
.Ed
.Pp
If a terminated process was created by an
.Xr execve 2 ,
the name of the executed file (at most ten characters of it)
is saved in the field
.Fa ac_comm
and its status is saved by setting one of more of the following flags in
.Fa ac_flag:
.Dv AFORK ,
.Dv ASU ,
.Dv ACOMPAT ,
.Dv ACORE
and
.Dv ASIG .
.Sh SEE ALSO
.Xr acct 2 ,
.Xr execve 2 ,
.Xr sa 8
.Sh HISTORY
A
.Nm
file format appeared in
.At v7 .