| 
 
 NAME
 SYNOPSIS
 DESCRIPTIONThe kernel maintains the following acct information structure for all processes. If a process terminates, and accounting is enabled, the kernel calls the acct(2) function call to prepare and append the record to the accounting file. #define AC_COMM_LEN 16
/*
 * Accounting structure version 3 (current).
 * The first byte is always zero.
 * Time units are microseconds.
 */
struct acctv3 {
	uint8_t  ac_zero;		/* zero identifies new version */
	uint8_t  ac_version;		/* record version number */
	uint16_t ac_len;		/* record length */
	char	  ac_comm[AC_COMM_LEN];	/* command name */
	float	  ac_utime;		/* user time */
	float	  ac_stime;		/* system time */
	float	  ac_etime;		/* elapsed time */
	time_t	  ac_btime;		/* starting time */
	uid_t	  ac_uid;		/* user id */
	gid_t	  ac_gid;		/* group id */
	float	  ac_mem;		/* average memory usage */
	float	  ac_io;		/* count of IO blocks */
	__dev_t   ac_tty;		/* controlling tty */
	uint16_t ac_len2;		/* record length */
	union {
		uint32_t  ac_align;	/* force v1 compatible alignment */
#define	AFORK	0x01			/* forked but not exec'ed */
/* ASU is no longer supported */
#define	ASU	0x02			/* used super-user permissions */
#define	ACOMPAT	0x04			/* used compatibility mode */
#define	ACORE	0x08			/* dumped core */
#define	AXSIG	0x10			/* killed by a signal */
#define ANVER	0x20			/* new record version */
		uint8_t  ac_flag;	/* accounting flags */
	} ac_trailer;
#define ac_flagx ac_trailer.ac_flag
};
If a terminated process was created by an
    execve(2),
    the name of the executed file (at most ten characters of it) is saved in the
    field ac_comm and its status is saved by setting one
    of more of the following flags in ac_flag:
     SEE ALSOHISTORYA  
 
  |