acct(5)

🎀 acct — the process accounting file, bestie 🎀

okay so real quick, the vibe: this is the acct(5) page from the File Formats Manual section, and it's literally all about the file where your kernel dumps a little receipt every time a process peaces out. iconic behavior honestly ✨

---

🌸 NAME 🌸

acct — process accounting file 💖

---

✨ SYNOPSIS ✨

#include <sys/acct.h>

that's it, that's the include. slay.

---

💅 DESCRIPTION 💅

So here's the tea 🫖 — if your kernel was built with the process accounting option turned on (CONFIG_BSD_PROCESS_ACCT), then calling acct(2) kicks off process accounting. Like, for example:

acct("/var/log/pacct");

Once process accounting is live, the kernel writes a record into the accounting file every single time a process on the system terminates. Yes, every one. obsessed with the thoroughness ngl.

That record is full of lore about the process that just dipped, and it's defined in <sys/acct.h> like this:

#define ACCT_COMM 16

typedef u_int16_t comp_t;

struct acct {
    char ac_flag;           /* Accounting flags */
    u_int16_t ac_uid;       /* Accounting user ID */
    u_int16_t ac_gid;       /* Accounting group ID */
    u_int16_t ac_tty;       /* Controlling terminal */
    u_int32_t ac_btime;     /* Process creation time
                               (seconds since the Epoch) */
    comp_t    ac_utime;     /* User CPU time */
    comp_t    ac_stime;     /* System CPU time */
    comp_t    ac_etime;     /* Elapsed time */
    comp_t    ac_mem;       /* Average memory usage (kB) */
    comp_t    ac_io;        /* Characters transferred (unused) */
    comp_t    ac_rw;        /* Blocks read or written (unused) */
    comp_t    ac_minflt;    /* Minor page faults */
    comp_t    ac_majflt;    /* Major page faults */
    comp_t    ac_swaps;     /* Number of swaps (unused) */
    u_int32_t ac_exitcode;  /* Process termination status
                               (see wait(2)) */
    char      ac_comm[ACCT_COMM+1];
                            /* Command name (basename of last
                               executed command; null-terminated) */
    char      ac_pad[X];    /* padding bytes */
};

enum {          /* Bits that may be set in ac_flag field */
    AFORK = 0x01,           /* Has executed fork, but no exec */
    ASU   = 0x02,           /* Used superuser privileges */
    ACORE = 0x08,           /* Dumped core */
    AXSIG = 0x10            /* Killed by a signal */
};

Now let's talk about comp_t because it's honestly the main character here 💫 — it's a floating-point value made of a 3-bit, base-8 exponent and a 13-bit mantissa. If you got a value, c, of this type, you can convert it to a (long) integer like so:

v = (c & 0x1fff) << (((c >> 13) & 0x7) * 3);

math ate, no crumbs left 🔥

And the ac_utime, ac_stime, and ac_etime fields measure time in "clock ticks" — so divide those values by sysconf(_SC_CLK_TCK) to turn them into seconds. cute little unit conversion moment 🧚

🦋 Version 3 accounting file format 🦋

Since Linux 2.6.8, there's an optional alternative version of the accounting file that can be produced if the CONFIG_BSD_PROCESS_ACCT_V3 option is set when you build the kernel. With this option set, the records written to the accounting file get extra fields, and the width of c_uid and ac_gid fields gets widened from 16 to 32 bits (in line with the increased size of UIDs and GIDs in Linux 2.4 and later). The records are defined like this:

struct acct_v3 {
    char      ac_flag;      /* Flags */
    char      ac_version;   /* Always set to ACCT_VERSION (3) */
    u_int16_t ac_tty;       /* Controlling terminal */
    u_int32_t ac_exitcode;  /* Process termination status */
    u_int32_t ac_uid;       /* Real user ID */
    u_int32_t ac_gid;       /* Real group ID */
    u_int32_t ac_pid;       /* Process ID */
    u_int32_t ac_ppid;      /* Parent process ID */
    u_int32_t ac_btime;     /* Process creation time */
    float     ac_etime;     /* Elapsed time */
    comp_t    ac_utime;     /* User CPU time */
    comp_t    ac_stime;     /* System time */
    comp_t    ac_mem;       /* Average memory usage (kB) */
    comp_t    ac_io;        /* Characters transferred (unused) */
    comp_t    ac_rw;        /* Blocks read or written
                               (unused) */
    comp_t    ac_minflt;    /* Minor page faults */
    comp_t    ac_majflt;    /* Major page faults */
    comp_t    ac_swaps;     /* Number of swaps (unused) */
    char      ac_comm[ACCT_COMM]; /* Command name */
};

glow up fr fr 🌈

---

🌟 VERSIONS 🌟

So even though this thing is present on most systems, it is not standardized, and the details vary somewhat between systems. so like, don't assume everyone's running the same game, iykyk 😭

---

💀 STANDARDS 💀

None.

that's it. that's the whole section. the silence is deafening bestie.

---

👑 HISTORY 👑

• glibc 2.6.
• Process accounting originated on BSD.

we love a humble origin story 💜

---

🌸 NOTES 🌸

• Records in the accounting file are ordered by termination time of the process.
• Up to and including Linux 2.6.9, a separate accounting record is written for each thread created using the NPTL threading library; since Linux 2.6.10, a single accounting record is written for the entire process on termination of the last thread in the process. character development honestly ✨
• The /proc/sys/kernel/acct file, described in proc(5), defines settings that control the behavior of process accounting when disk space runs low. so like… keep an eye on that 🫶

---

🔥 SEE ALSO 🔥

• lastcomm(1)
• acct(2)
• accton(8)
• sa(8)

---

and that's the whole page bestie, we ate and left absolutely no crumbs 💅✨

this lil masterpiece is from Linux man-pages 6.20, dated 2026-02-08 — go forth and account for your processes, periodt 🎀🦋💖