summaryrefslogtreecommitdiff
path: root/static/openbsd/man5/acct.5
diff options
context:
space:
mode:
authorJacob McDonnell <jacob@jacobmcdonnell.com>2026-04-25 14:02:27 -0400
committerJacob McDonnell <jacob@jacobmcdonnell.com>2026-04-25 14:02:27 -0400
commit6d8bdc65446a704d0750217efd05532fc641ea7d (patch)
tree8ae6d698b3c9801750a8b117b3842fb369872a3a /static/openbsd/man5/acct.5
parent2f467bd7ff8f8db0dafa40426166491d7f57f368 (diff)
docs: OpenBSD Man Pages Added
Diffstat (limited to 'static/openbsd/man5/acct.5')
-rw-r--r--static/openbsd/man5/acct.5157
1 files changed, 157 insertions, 0 deletions
diff --git a/static/openbsd/man5/acct.5 b/static/openbsd/man5/acct.5
new file mode 100644
index 00000000..82ea470b
--- /dev/null
+++ b/static/openbsd/man5/acct.5
@@ -0,0 +1,157 @@
+.\" $OpenBSD: acct.5,v 1.27 2024/02/25 00:07:14 deraadt Exp $
+.\" $NetBSD: acct.5,v 1.4 1995/10/22 01:40:10 ghudson Exp $
+.\"
+.\" Copyright (c) 1991, 1993
+.\" The Regents of the University of California. All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\" notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\" notice, this list of conditions and the following disclaimer in the
+.\" documentation and/or other materials provided with the distribution.
+.\" 3. Neither the name of the University nor the names of its contributors
+.\" may be used to endorse or promote products derived from this software
+.\" without specific prior written permission.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.\" @(#)acct.5 8.1 (Berkeley) 6/5/93
+.\"
+.Dd $Mdocdate: February 25 2024 $
+.Dt ACCT 5
+.Os
+.Sh NAME
+.Nm acct
+.Nd execution accounting file
+.Sh SYNOPSIS
+.In sys/acct.h
+.Sh DESCRIPTION
+The kernel maintains the following
+.Fa acct
+information structure for all
+processes.
+If a process terminates or misbehaves in specific ways,
+and accounting is enabled, the kernel calls the
+.Xr acct 2
+function call to prepare and append the record
+to the accounting file.
+.Bd -literal
+/*
+ * Accounting structures; these use a comp_t type which is a 3 bits base 8
+ * exponent, 13 bit fraction floating point number. Units are 1/AHZ
+ * seconds.
+ */
+typedef u_int16_t comp_t;
+
+struct acct {
+ char ac_comm[24]; /* command name, incl NUL */
+ comp_t ac_utime; /* user time */
+ comp_t ac_stime; /* system time */
+ comp_t ac_etime; /* elapsed time */
+ comp_t ac_io; /* count of IO blocks */
+ time_t ac_btime; /* starting time */
+ uid_t ac_uid; /* user id */
+ gid_t ac_gid; /* group id */
+ u_int32_t ac_mem; /* average memory usage */
+ dev_t ac_tty; /* controlling tty, or -1 */
+ pid_t ac_pid; /* process id */
+
+ u_int32_t ac_flag; /* accounting flags */
+#define AFORK 0x00000001 /* fork'd but not exec'd */
+#define AMAP 0x00000004 /* killed by syscall or stack mapping violation */
+#define ACORE 0x00000008 /* dumped core */
+#define AXSIG 0x00000010 /* killed by a signal */
+#define APLEDGE 0x00000020 /* killed due to pledge violation */
+#define ATRAP 0x00000040 /* memory access violation */
+#define AUNVEIL 0x00000080 /* unveil access violation */
+#define APINSYS 0x00000200 /* killed by syscall pin violation */
+#define ABTCFI 0x00000400 /* BT CFI violation */
+};
+
+/*
+ * 1/AHZ is the granularity of the data encoded in the comp_t fields.
+ * This is not necessarily equal to hz.
+ */
+#define AHZ 64
+
+#ifdef _KERNEL
+int acct_process(struct proc *p);
+int acct_shutdown(void);
+#endif
+.Ed
+.Pp
+If a terminated or misbehaving process was created by an
+.Xr execve 2 ,
+the name of the executed file (at most ten characters of it)
+is saved in the field
+.Fa ac_comm
+and its status is saved by setting one or more of the following flags in
+.Fa ac_flag :
+.Bl -tag -width "AUNVEIL"
+.It Dv AFORK
+A new process was created via
+.Xr fork 2
+that was not followed by a call to
+.Xr execve 2 .
+.It Dv AMAP
+The process terminated abnormally due to a system call or stack mapping
+violation.
+.It Dv ACORE
+The process terminated abnormally due to a signal and dumped
+.Xr core 5 .
+.It Dv AXSIG
+The process was killed by a
+.Xr signal 3 .
+.It Dv APLEDGE
+The process was killed due to a
+.Xr pledge 2
+violation.
+.It Dv ATRAP
+The process was killed due to a memory access violation
+detected by a processor trap.
+.It Dv AUNVEIL
+The process attempted a file access that was prevented by
+.Xr unveil 2
+restrictions.
+Note that this does not cause the process to terminate.
+.It Dv APINSYS
+The command tried to execute a system call from the wrong
+system call instruction, see
+.Xr pinsyscalls 2 .
+.It Dv ABTCFI
+The command executed an indirect branch to a location that did not
+start with a
+.Ql BTI
+instruction, and terminated with signal
+.Dv SIGILL ,
+.Va code
+.Dv ILL_BTCFI .
+.El
+.Sh SEE ALSO
+.Xr lastcomm 1 ,
+.Xr acct 2 ,
+.Xr execve 2 ,
+.Xr pledge 2 ,
+.Xr unveil 2 ,
+.Xr signal 3 ,
+.Xr core 5 ,
+.Xr accton 8 ,
+.Xr sa 8
+.Sh HISTORY
+An
+.Nm
+file format first appeared in
+.At v7 .