How Process Accounting Works

The acct() System Call

acct() is the system call that enables or disables process accounting. Only a privileged process (with CAP_SYS_PACCT capability) can call it.

/* Prototype */
#include <unistd.h>

int acct(const char *acctfile);
/* Returns 0 on success, -1 on error */

/* To ENABLE: pass a pathname to an existing file */
acct("/var/log/pacct");

/* To DISABLE: pass NULL */
acct(NULL);

Example 1 — Enable and Disable Process Accounting

This program takes an optional filename argument. If given, it enables accounting to that file. If no argument, it disables accounting.

/* acct_toggle.c — Enable or disable process accounting */
#define _BSD_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

int main(int argc, char *argv[])
{
    if (argc > 2) {
        fprintf(stderr, "Usage: %s [file]\n", argv[0]);
        exit(EXIT_FAILURE);
    }

    /* argv[1] is the accounting file path, or NULL to disable */
    if (acct(argc > 1 ? argv[1] : NULL) == -1) {
        perror("acct");
        exit(EXIT_FAILURE);
    }

    printf("Process accounting %s\n",
           (argc == 1) ? "disabled" : "enabled");

    exit(EXIT_SUCCESS);
}

The acct Structure — What Gets Recorded

For every process that terminates, the kernel fills in this structure and appends it to the accounting file.

/* From <sys/acct.h> */
typedef u_int16_t comp_t;   /* Compressed clock ticks — see below */

struct acct {
    char      ac_flag;      /* Accounting flags (AFORK, ASU, AXSIG, ACORE) */
    u_int16_t ac_uid;       /* User ID of the process */
    u_int16_t ac_gid;       /* Group ID of the process */
    u_int16_t ac_tty;       /* Controlling terminal (0 if daemon) */
    u_int32_t ac_btime;     /* Start time (seconds since the Epoch) */
    comp_t    ac_utime;     /* User CPU time (clock ticks) */
    comp_t    ac_stime;     /* System (kernel) CPU time (clock ticks) */
    comp_t    ac_etime;     /* Elapsed real time (clock ticks) */
    comp_t    ac_mem;       /* Average memory usage (kilobytes) */
    comp_t    ac_io;        /* Bytes read/written (unused in Linux) */
    comp_t    ac_rw;        /* Blocks read/written (unused) */
    comp_t    ac_minflt;    /* Minor page faults (Linux-specific) */
    comp_t    ac_majflt;    /* Major page faults (Linux-specific) */
    comp_t    ac_swaps;     /* Number of swaps (unused; Linux-specific) */
    u_int32_t ac_exitcode;  /* Process termination status */
    char      ac_comm[17];  /* Command name (last execve basename) */
    char      ac_pad[10];   /* Padding for future use */
};

ac_flag Bit Values

Understanding comp_t (Compressed Clock Ticks)

Time fields (ac_utime, ac_stime, ac_etime) use the comp_t type — a compressed floating-point format stored in 16 bits. It has a 13-bit mantissa and a 3-bit base-8 exponent.

Example 2 — Decode comp_t to Seconds

/* compt_decode.c — Convert comp_t to actual time in seconds */
#include <stdio.h>
#include <stdint.h>
#include <sys/acct.h>
#include <unistd.h>

/* Convert comp_t value to long long clock ticks */
static long long comptToLL(comp_t ct)
{
    const int EXP_BITS  = 3;            /* 3-bit base-8 exponent */
    const int MANT_BITS = 13;           /* 13-bit mantissa */
    const int MANT_MASK = (1 << MANT_BITS) - 1;  /* 0x1FFF */

    long long mantissa = ct & MANT_MASK;
    long long exponent = (ct >> MANT_BITS) & ((1 << EXP_BITS) - 1);

    /* Multiply mantissa by 8^exponent = left-shift by (exponent * 3) bits */
    return mantissa << (exponent * 3);
}

int main(void)
{
    /* Example: read a few records and print CPU time in seconds */
    FILE *fp = fopen("/var/log/pacct", "rb");
    if (!fp) { perror("fopen"); return 1; }

    struct acct ac;
    long clk_tck = sysconf(_SC_CLK_TCK);  /* Usually 100 ticks/sec */

    printf("%-16s %8s %8s %8s\n",
           "Command", "User(s)", "Sys(s)", "Elapsed(s)");
    printf("%-16s %8s %8s %8s\n",
           "-------", "------", "-----", "--------");

    while (fread(&ac, sizeof(ac), 1, fp) == 1) {
        double utime = (double) comptToLL(ac.ac_utime) / clk_tck;
        double stime = (double) comptToLL(ac.ac_stime) / clk_tck;
        double etime = (double) comptToLL(ac.ac_etime) / clk_tck;

        printf("%-16.16s %8.2f %8.2f %8.2f\n",
               ac.ac_comm, utime, stime, etime);
    }

    fclose(fp);
    return 0;
}

/proc/sys/kernel/acct — Disk Space Control

Accounting files can grow rapidly. Linux provides a virtual file to suspend accounting when disk space is low.

/* Read and display current /proc/sys/kernel/acct settings */
#include <stdio.h>

int main(void)
{
    FILE *fp = fopen("/proc/sys/kernel/acct", "r");
    if (!fp) { perror("fopen"); return 1; }

    int high, low, freq;
    fscanf(fp, "%d %d %d", &high, &low, &freq);
    fclose(fp);

    printf("Process accounting disk control:\n");
    printf("  high-water: %d%% (resume accounting above this)\n", high);
    printf("  low-water:  %d%% (suspend accounting below this)\n", low);
    printf("  frequency:  %d seconds between checks\n", freq);
    return 0;
}

Process Accounting Version 3 (acct_v3)

From kernel 2.6.8, Linux introduced an improved accounting format enabled with CONFIG_BSD_PROCESS_ACCT_V3. It fixes two major limitations of the original format.

/* acct_v3 structure — available from kernel 2.6.8 onwards */
struct acct_v3 {
    char      ac_flag;       /* Accounting flags */
    char      ac_version;    /* Always 3 for this format */
    u_int16_t ac_tty;        /* Controlling terminal */
    u_int32_t ac_exitcode;   /* Termination status */
    u_int32_t ac_uid;        /* 32-bit user ID (fixed from 16-bit) */
    u_int32_t ac_gid;        /* 32-bit group ID */
    u_int32_t ac_pid;        /* Process ID (new in v3) */
    u_int32_t ac_ppid;       /* Parent process ID (new in v3) */
    u_int32_t ac_btime;      /* Start time (time_t) */
    float     ac_etime;      /* Elapsed time as float (wider range) */
    comp_t    ac_utime;      /* User CPU time */
    comp_t    ac_stime;      /* System CPU time */
    comp_t    ac_mem;        /* Average memory usage (KB) */
    comp_t    ac_io;         /* Bytes read/written (unused) */
    comp_t    ac_rw;         /* Blocks read/written (unused) */
    comp_t    ac_minflt;     /* Minor page faults */
    comp_t    ac_majflt;     /* Major page faults */
    comp_t    ac_swaps;      /* Number of swaps (unused) */
    char      ac_comm[16];   /* Command name */
};

/* Check which version we are reading */
void check_version(const char *file)
{
    /* Read first byte — if it's 3, it's a v3 file */
    FILE *fp = fopen(file, "rb");
    if (!fp) return;

    struct acct_v3 rec;
    if (fread(&rec, sizeof(rec), 1, fp) == 1) {
        printf("Version: %d\n", (unsigned char)rec.ac_version);
        printf("PID: %u, PPID: %u\n", rec.ac_pid, rec.ac_ppid);
    }
    fclose(fp);
}

Interview Questions