ACCT(2)

💖 ACCT(2) — the acct system call, section 2 of the System Calls Manual 💖

okay bestie so we're doing acct today and honestly? it's giving accountant energy but in a cool way. system calls manual, section 2, let's go 🫶

---

✨ NAME ✨

acct — enable or disable process accounting

like, it turns the bean-counting on and off. that's the whole vibe. 💅

---

📚 LIBRARY 📚

Standard C Library (libc, -lc)

yep, plain old libc, no fancy extra library needed, we love a low-maintenance icon 🌸

---

🎀 SYNOPSIS 🎀

#include <unistd.h>

int
acct(const char *file);

look at her. one argument. one int return. no drama. 👑

---

🦋 DESCRIPTION 🦋

so the acct() system call enables or disables the collection of system accounting records. literally what it says on the tin, no cap.

if the argument file is a null pointer, accounting is disabled. done, off, goodnight. 😴

if file is an existing pathname (null-terminated, obvi), record collection is enabled and — here's the part you gotta know — for every process initiated which terminates under normal conditions, an accounting record gets appended to file. every single one. she's thorough. 💖

now, "abnormal conditions of termination"? that's reboots or other fatal system problems. so if the box just dies, no receipt, sorry bestie. 😭

and heads up: records for processes which never terminate cannot be produced by acct(). if it never ends, there's nothing to write. it's giving forever-loop energy, and honestly? not our problem. 💀

for more info on the record structure used by acct(), go peek at <sys/acct.h> and acct(5). the lore is all there, iykyk 📖

also important: this call is permitted only to the super-user. root only, babes. the rest of us are just watching. 👑

---

⭐ NOTES ⭐

okay this part is lowkey the best part because she's got ✨self-preservation✨:

Accounting is automatically disabled when the file system the accounting file resides on runs out of space — and it's enabled when space once again becomes available. like she just quietly pauses when the disk is full and picks back up when there's room. main character behaviour, truly. 💅

the values controlling this behaviour can be modified using the following sysctl(8) variables:

• kern.acct_chkfreq — Specifies the frequency (in seconds) with which free disk space should be checked. basically how often she looks at the disk like "u good?" 👀
• kern.acct_resume — The percentage of free disk space above which process accounting will resume. cross this line and we're back, baby 🌈
• kern.acct_suspend — The percentage of free disk space below which process accounting will suspend. dip under this and she's napping 😴

---

🌟 RETURN VALUES 🌟

on error, -1 is returned. periodt.

The file must exist and the call may be exercised only by the super-user. so: file exists ✅, root ✅, or you get the -1. 🙈

---

💀 ERRORS 💀

The acct() system call will fail if one of the following is true:

• [EPERM] — The caller is not the super-user. sorry bestie, you're not on the list 🚫
• [ENOTDIR] — A component of the path prefix is not a directory. that's not a folder, that's... something else 🫠
• [ENAMETOOLONG] — A component of a pathname exceeded 255 characters, or an entire path name exceeded 1023 characters. girl, the name is TOO LONG 😭
• [ENOENT] — The named file does not exist. it's not there. nowhere. vanished. 💀
• [EACCES] — Search permission is denied for a component of the path prefix, or the path name is not a regular file. no entry for you ✋
• [ELOOP] — Too many symbolic links were encountered in translating the pathname. the symlinks are linking in circles, iconic but illegal 🌀
• [EROFS] — The named file resides on a read-only file system. can't write to a read-only disk, that's just facts 🔒
• [EFAULT] — The file argument points outside the process's allocated address space. that pointer is out of bounds, bestie, put it down 🫣
• [EIO] — An I/O error occurred while reading from or writing to the file system. the disk is having a moment 😵
• [EINTEGRITY] — Corrupted data was detected while reading from the file system. the data is not okay. corrupted. bad vibes. 🔥

---

🔍 SEE ALSO 🔍

acct(5), accton(8), sa(8)

go read those next, they're the supporting cast and they ate 🍓

---

🌈 HISTORY 🌈

The acct() function appeared in Version 7 AT&T UNIX. an elder. a legend. a pioneer. we respect the OGs 👑

---

and that's the whole page, bestie — from Debian, dated March 30, 2020, ACCT(2), signing off 🎀 thanks for reading my little manpage essay, go enable some accounting (as root!!) and slay ✨💜