2.9BSD/usr/man/man5/acct.5

.TH ACCT 5
.UC
.SH NAME
acct \- execution accounting file
.SH SYNOPSIS
.B #include <sys/types.h>
.br
.B #include <sys/acct.h>
.SH DESCRIPTION
.IR Acct (2)
causes entries to be made into an accounting file
for each process that terminates.
The accounting file is a sequence of entries whose layout,
as defined by the include file
is:
.PP
.nf
.ta \w'typedef 'u +\w'comp_t  'u +\w'ac_comm[10]; 'u
/*
 * Accounting structures;
 * these use a comp_t type which is a 3 bits base 8
 * exponent, 13 bit fraction ``floating point'' number.
 */

struct	acct
{
	char	ac_comm[10];		/* Accounting command name */
	comp_t	ac_utime;		/* Accounting user time */
	comp_t	ac_stime;		/* Accounting system time */
	comp_t	ac_etime;		/* Accounting elapsed time */
	time_t	ac_btime;		/* Beginning time */
	short	ac_uid;			/* Accounting user ID */
	short	ac_gid;			/* Accounting group ID */
	short	ac_mem;			/* average memory usage */
	comp_t	ac_io;			/* number of disk IO blocks */
	dev_t	ac_tty;			/* control typewriter */
	char	ac_flag;		/* Accounting flag */
#ifdef	UCB_LOGIN
	char	ac_crn[4];		/* Accounting charge number */
	short	ac_magic;		/* Magic number for synchronization */
#endif
};

#if	defined(KERNEL) && defined(ACCT)
extern	struct	acct	acctbuf;
extern	struct	inode	*acctp;		/* inode of accounting file */
#endif

#define	AFORK	01		/* has executed fork, but no exec */
#define	ASU	02		/* used super-user privileges */

#ifdef	UCB_SUBM
#define	ASUBM	04		/* submitted process */
#endif

#ifdef	UCB_LOGIN
#define	AMAGIC	052525		/* magic number */
#endif
.fi
.PP
If the process does an
.IR execve (2),
the first 10 characters of the filename appear in
.I ac\_comm.
The accounting flag contains bits indicating whether
.IR execve (2)
was ever accomplished, and whether the
process ever had super-user privileges.
.SH SEE ALSO
acct(2), sa(8)