acct(2)

💖 acct(2) — the process accounting switch 💖

okay bestie, so this is a page from the System Calls Manual (yes, section 2, we're in kernel-land, it's giving syscall energy ✨) and honestly? it's such a lil guy with such big power. let's get into it 🫶

---

🌸 NAME 🌸

acct — switch process accounting on or off

like... a literal on/off switch for the receipt-printer of your system. bestie is a toggler 💅

---

📚 LIBRARY 📚

Standard C library (libc, -lc)

so you already have it, no extra install, no extra drama 🎀

---

✨ SYNOPSIS ✨

#include <unistd.h>

int acct(const char *_Nullable path);

🦋 Feature Test Macro Requirements for glibc 🦋

(peep feature_test_macros(7) if you need the lore, iykyk)

acct():

• Since glibc 2.21:
  • _DEFAULT_SOURCE
• In glibc 2.19 and 2.20:
  • _DEFAULT_SOURCE || (_XOPEN_SOURCE && _XOPEN_SOURCE < 500)
• Up to and including glibc 2.19:
  • _BSD_SOURCE || (_XOPEN_SOURCE && _XOPEN_SOURCE < 500)

so basically, depending on which glibc era you're living in, you gotta define the right macro or this thing ghosts you 😭 define responsibly!

---

💜 DESCRIPTION 💜

The acct() system call enables or disables process accounting. periodt.

Here's the tea ☕ — pass it the pathname of an existing file as its argument and accounting gets turned on, and then records for every single terminating process get appended to that file as each one terminates. like a lil diary where every process writes its final entry before it exits. so sentimental honestly 🥹

And if you pass NULL as the argument? accounting gets turned off. that's it, that's the whole switch. iconic behaviour, no notes 👑

---

🔥 RETURN VALUE 🔥

• On success: zero is returned. slay. ✅
• On error: -1 is returned, and errno is set to tell you what went wrong. rude but informative 💀

---

😭 ERRORS 😭

okay so this is the part where things can go sideways. every one of these is a real mood, let's go through them:

• EACCES — Write permission is denied for the specified file, or search permission is denied for one of the directories in the path prefix of path (peep path_resolution(7) for that whole saga), or path is not a regular file.
• EFAULT — path points outside your accessible address space. bestie is pointing at ✨the void✨ outside your memory.
• EIO — Error writing to the file path. the write just... didn't write.
• EISDIR — path is a directory. bestie, that's a folder, not a file, that's not it 🙈
• ELOOP — Too many symbolic links were encountered in resolving path. symlink rabbit hole, we've all been there 🕳️
• ENAMETOOLONG — path was too long. it's giving novel, not pathname 📖
• ENFILE — The system-wide limit on the total number of open files has been reached. the whole system ran out of file slots, not just you.
• ENOENT — The specified path does not exist. it's not real, it was never real 💀
• ENOMEM — Out of memory. no thoughts, head empty, RAM empty.
• ENOSYS — BSD process accounting has not been enabled when the operating system kernel was compiled. the kernel config parameter that controls this feature is CONFIG_BSD_PROCESS_ACCT. so if your kernel wasn't built with it, this syscall is lowkey just a rumour 🌫️
• ENOTDIR — A component used as a directory in path is not in fact a directory. it was pretending. fraud alert 🚨
• EPERM — The calling process has insufficient privilege to enable process accounting. on Linux, the CAP_SYS_PACCT capability is required. so no cap (capability), no CAP_SYS_PACCT 🔑
• EROFS — path refers to a file on a read-only filesystem. you cannot write to the read-only, that's literally the whole point 🧊
• EUSERS — There are no more free file structures or we ran out of memory. two-for-one chaos.

fr fr read these, don't just skim. EPERM is the one that gets people — if you don't have CAP_SYS_PACCT, it's over before it started 😔

---

🎀 STANDARDS 🎀

None. nope, not standardized, no committee signing off on this one, it's just out here living its life 🌈

---

⭐ HISTORY ⭐

• SVr4
• 4.3BSD

vintage! a classic! we stan an elder 🍓

---

🌟 NOTES 🌟

• No accounting is produced for programs running when a system crash occurs. and in particular, nonterminating processes are never accounted for. so if a process never ends, it never gets a diary entry. it simply persists. main character energy, honestly, refusing to have an exit 💅
• The structure of the records written to the accounting file is described in acct(5). go peep that page for the record layout lore 📓

---

💫 SEE ALSO 💫

• acct(5)

---

okay bestie that's the whole page!! you now know how to flip process accounting on and off, every reason it might scream at you, and the fact that crashed systems just lose the receipts 😭 go forth and toggle responsibly 🫶✨

this lil rewrite was brought to you by Linux man-pages 6.20, dated 2025-05-17 — mwah, love u, bye 💖🎀🦋