acct(5) File Formats Manual acct(5) acct - #include (CONFIG_BSD_PROCESS_ACCT), acct(2) : acct("/var/log/pacct"); , . : #define ACCT_COMM 16 typedef u_int16_t comp_t; struct acct { char ac_flag; /* Accounting flags */ u_int16_t ac_uid; /* Accounting user ID */ u_int16_t ac_gid; /* Accounting group ID */ u_int16_t ac_tty; /* Controlling terminal */ u_int32_t ac_btime; /* Process creation time (seconds since the Epoch) */ comp_t ac_utime; /* User CPU time */ comp_t ac_stime; /* System CPU time */ comp_t ac_etime; /* Elapsed time */ comp_t ac_mem; /* Average memory usage (kB) */ comp_t ac_io; /* Characters transferred (unused) */ comp_t ac_rw; /* Blocks read or written (unused) */ comp_t ac_minflt; /* Minor page faults */ comp_t ac_majflt; /* Major page faults */ comp_t ac_swaps; /* Number of swaps (unused) */ u_int32_t ac_exitcode; /* Process termination status (see wait(2)) */ char ac_comm[ACCT_COMM+1]; /* Command name (basename of last executed command; null-terminated) */ char ac_pad[X]; /* padding bytes */ }; enum { /* Bits that may be set in ac_flag field */ AFORK = 0x01, /* Has executed fork, but no exec */ ASU = 0x02, /* Used superuser privileges */ ACORE = 0x08, /* Dumped core */ AXSIG = 0x10 /* Killed by a signal */ }; comp_t - , 3- 8 13- . c (long) : v = (c & 0x1fff) << (((c >> 13) & 0x7) * 3); ac_utime, ac_stime ac_etime " "; sysconf(_SC_CLK_TCK). 3 2.6.8, , CONFIG_BSD_PROCESS_ACCT_V3 . , , , , c_uid ac_gid 16 32 ( UID GID Linux 2.4 ). : struct acct_v3 { char ac_flag; /* Flags */ char ac_version; /* Always set to ACCT_VERSION (3) */ u_int16_t ac_tty; /* Controlling terminal */ u_int32_t ac_exitcode; /* Process termination status */ u_int32_t ac_uid; /* Real user ID */ u_int32_t ac_gid; /* Real group ID */ u_int32_t ac_pid; /* Process ID */ u_int32_t ac_ppid; /* Parent process ID */ u_int32_t ac_btime; /* Process creation time */ float ac_etime; /* Elapsed time */ comp_t ac_utime; /* User CPU time */ comp_t ac_stime; /* System time */ comp_t ac_mem; /* Average memory usage (kB) */ comp_t ac_io; /* Characters transferred (unused) */ comp_t ac_rw; /* Blocks read or written (unused) */ comp_t ac_minflt; /* Minor page faults */ comp_t ac_majflt; /* Major page faults */ comp_t ac_swaps; /* Number of swaps (unused) */ char ac_comm[ACCT_COMM]; /* Command name */ }; , . . glibc 2.6. BSD. . Linux 2.6.9, , , NPTL, . Linux 2.6.10, , . /proc/sys/kernel/acct, proc(5), , . lastcomm(1), acct(2), accton(8), sa(8) () Dmitry Bolkhovskikh , Yuri Kozlov , Aleksandr Felda Kirill Rekhov ; GNU (GNU General Public License - GPL, 3 ) , - . - , , () () () <>. Linux 6.9.1 2 2024 . acct(5)