ACCT(5) File Formats Manual ACCT(5)NAME
acct - execution accounting file
The acct(2) system call arranges for entries to be made in an accounting file for each process that terminates. The accounting file is a
sequence of entries whose layout, as defined by the include file is:
If the process was created by an execve(2), the first 10 characters of the filename appear in ac_comm. The accounting flag contains bits
indicating whether execve(2) was ever accomplished, and whether the process ever had super-user privileges.
SEE ALSO acct(2), execve(2), sa(8)7th Edition May 19, 1986 ACCT(5)
Check Out this Related Man Page
acct(5) File Formats Manual acct(5)Name
acct - execution accounting file
The system call makes entries in an accounting file for each process that terminates. The accounting file is a sequence of entries whose
layout, as defined by the include file, is:
typedef u_short comp_t
char ac_comm; /* Accounting command name */
comp_t ac_utime; /* Accounting user time */
comp_t ac_stime; /* Accounting system time */
comp_t ac_etime; /* Accounting elapsed time */
time_t ac_btime; /* Beginning time */
short ac_uid; /* Accounting user ID */
short ac_gid; /* Accounting group ID */
short ac_mem; /* average memory usage */
comp_t ac_io; /* number of disk IO blocks */
dev_t ac_tty; /* control typewriter */
char ac_flag; /* Accounting flag */
#define AFORK 0001 /* has executed fork, but no exec */
#define ASU 0002 /* used super-user privileges */
#define ACOMPAT 0004 /* used compatibility mode */
#define ACORE 0010 /* dumped core */
#define AXSIG 0020 /* killed by a signal */
#define AHZ 64 /* the accuracy of data is 1/AHZ */
struct acct acctbuf;
struct gnode *acctp;
If the process does an the first 10 characters of the file name appear in ac_comm. The accounting flag contains bits indicating whether
was ever accomplished and whether the process ever had superuser privileges.
See Alsoacct(2), execve(2), sa(8)
I'm Sun Solaris, I have problems on figuring out how i can start acct in unix. I understand how this accounting write in a file in /var/adm/wtmp. And with "acctcom -b " shows end part of all commands that were written in it. And "accton" shuts off this reporting. My question how... (3 Replies)
I recently started using unix in osx,and loving it! I am now wanting to use pine for email. I installed it using fink and besides it not being the most updated version, it seems to work fine, except that every message I erase seems to come back everytime I log in. It is a pop3 account. I have also... (0 Replies)
How do I enable System Accounting on Solaris 8? In Solaris 7 I would copy the /usr/lib/acct file to S22acct and start it like that. That doesn't seem to be an option in Solaris 8.
Thanks for your help! (2 Replies)
I want to know the any process end time using the "acctcom" command.
I think "ps" command will give only running processes Start time.
But i want know the running & completed processes:
1. Start Time
2. End Time
3. Process Name/Command Name
Please... (1 Reply)
My scenario is as follows:
We have a handful of batch accounts that run our production jobs. Our users are able to use sudo to become that account. Also, because of other reasons, the passwords are also listed in an encrypted file that each team can see their batch ID. So, I have some users... (5 Replies)
I need to figure out why did the system run out of memory and hung at a certain time. For further investigation, the info about every processes' CPU and memory consumption over time would be of high value.
I see, that Unix accounting may be of some help. But I'm not sure if I can get this... (3 Replies)
I need to write a script, which takes the input a log file and create output file with acct no's line by line from selected records with text like (in red) :
18:51:18 | 217863|Acct 0110855565|RC 17608| 16 Subs| 1596 UsgRecs| 2 Secs| 430 CPUms| prmis2:26213 <MoveUsage d
aemon needs to run... (7 Replies)
I have a txt file with contents of acct nbr's like:
I need to write a script which takes each acct nbr in the file and run the query like:
select seq_nbr from event where acct_nbr='22222222222'
and the query's output should be passed to a... (2 Replies)
Examining the Debian Linux logfiles, I found out that not all commands are logged in my pacct (/var/log/account/pacct)
For instance, if I run and stop Wireshark and do after that
# lastcomm | grep "wireshark"
The wireshark command is logged as expected.
# lastcomm | grep... (1 Reply)