ACCT(5) File Formats Manual ACCT(5)NAME
acct - execution accounting file
SYNOPSIS
#include <sys/acct.h>
DESCRIPTION
The acct(2) system call arranges for entries to be made in an accounting file for each process that terminates. The accounting file is a
sequence of entries whose layout, as defined by the include file is:
If the process was created by an execve(2), the first 10 characters of the filename appear in ac_comm. The accounting flag contains bits
indicating whether execve(2) was ever accomplished, and whether the process ever had super-user privileges.
SEE ALSO acct(2), execve(2), sa(8)7th Edition May 19, 1986 ACCT(5)
Check Out this Related Man Page
ACCT(2) System Calls Manual ACCT(2)NAME
acct - turn accounting on or off
SYNOPSIS
acct(file)
char *file;
DESCRIPTION
The system is prepared to write a record in an accounting file for each process as it terminates. This call, with a null-terminated string
naming an existing file as argument, turns on accounting; records for each terminating process are appended to file. An argument of 0
causes accounting to be turned off.
The accounting file format is given in acct(5).
This call is permitted only to the super-user.
NOTES
Accounting is automatically disabled when the file system the accounting file resides on runs out of space; it is enabled when space once
again becomes available.
RETURN VALUE
On error -1 is returned. The file must exist and the call may be exercised only by the super-user. It is erroneous to try to turn on
accounting when it is already on.
ERRORS
Acct will fail if one of the following is true:
[EPERM] The caller is not the super-user.
[ENOTDIR] A component of the path prefix is not a directory.
[EINVAL] The pathname contains a character with the high-order bit set.
[ENAMETOOLONG] A component of a pathname exceeded 255 characters, or an entire path name exceeded 1023 characters.
[ENOENT] The named file does not exist.
[EACCES] Search permission is denied for a component of the path prefix, or the path name is not a regular file.
[ELOOP] Too many symbolic links were encountered in translating the pathname.
[EROFS] The named file resides on a read-only file system.
[EFAULT] File points outside the process's allocated address space.
[EIO] An I/O error occurred while reading from or writing to the file system.
SEE ALSO acct(5), sa(8)BUGS
No accounting is produced for programs running when a crash occurs. In particular non-terminating programs are never accounted for.
4th Berkeley Distribution May 22, 1986 ACCT(2)
When i excute the command:
# /usr/sbin/acct/accton /var/adm/acct
it prompt error:
#/usr/sbin/acct/accton: file mode not 0664
Who can help me to start process-accounting procedures,Thanks! (2 Replies)
Hi everybody,
I'm Sun Solaris, I have problems on figuring out how i can start acct in unix. I understand how this accounting write in a file in /var/adm/wtmp. And with "acctcom -b " shows end part of all commands that were written in it. And "accton" shuts off this reporting. My question how... (3 Replies)
I recently started using unix in osx,and loving it! I am now wanting to use pine for email. I installed it using fink and besides it not being the most updated version, it seems to work fine, except that every message I erase seems to come back everytime I log in. It is a pop3 account. I have also... (0 Replies)
How do I enable System Accounting on Solaris 8? In Solaris 7 I would copy the /usr/lib/acct file to S22acct and start it like that. That doesn't seem to be an option in Solaris 8.
Thanks for your help! (2 Replies)
Hi All,
I want to know the any process end time using the "acctcom" command.
I think "ps" command will give only running processes Start time.
But i want know the running & completed processes:
1. Start Time
2. End Time
3. Process Name/Command Name
4. PID
Please... (1 Reply)
Hi,
On my server there are so many pacct files in /var/adm. It is eating up my /var partition. Can I delete or gzip those files ?
Thanks
NeeleshG (3 Replies)
My scenario is as follows:
We have a handful of batch accounts that run our production jobs. Our users are able to use sudo to become that account. Also, because of other reasons, the passwords are also listed in an encrypted file that each team can see their batch ID. So, I have some users... (5 Replies)
I need to figure out why did the system run out of memory and hung at a certain time. For further investigation, the info about every processes' CPU and memory consumption over time would be of high value.
I see, that Unix accounting may be of some help. But I'm not sure if I can get this... (3 Replies)
I am trying to show the number of dead accts or false shells running and include a count at the end. Does anyone know how to go about this? Thanks - citizencro (3 Replies)
I need to write a script, which takes the input a log file and create output file with acct no's line by line from selected records with text like (in red) :
18:51:18 | 217863|Acct 0110855565|RC 17608| 16 Subs| 1596 UsgRecs| 2 Secs| 430 CPUms| prmis2:26213 <MoveUsage d
aemon needs to run... (7 Replies)
I have a txt file with contents of acct nbr's like:
22222222222
33333333333
33445566778
I need to write a script which takes each acct nbr in the file and run the query like:
select seq_nbr from event where acct_nbr='22222222222'
and the query's output should be passed to a... (2 Replies)
Hi,
Examining the Debian Linux logfiles, I found out that not all commands are logged in my pacct (/var/log/account/pacct)
For instance, if I run and stop Wireshark and do after that
# lastcomm | grep "wireshark"
The wireshark command is logged as expected.
# lastcomm | grep... (1 Reply)