diff options
| author | Jacob McDonnell <jacob@jacobmcdonnell.com> | 2026-04-25 14:02:27 -0400 |
|---|---|---|
| committer | Jacob McDonnell <jacob@jacobmcdonnell.com> | 2026-04-25 14:02:27 -0400 |
| commit | 6d8bdc65446a704d0750217efd05532fc641ea7d (patch) | |
| tree | 8ae6d698b3c9801750a8b117b3842fb369872a3a /static/openbsd/man5/acct.5 | |
| parent | 2f467bd7ff8f8db0dafa40426166491d7f57f368 (diff) | |
docs: OpenBSD Man Pages Added
Diffstat (limited to 'static/openbsd/man5/acct.5')
| -rw-r--r-- | static/openbsd/man5/acct.5 | 157 |
1 files changed, 157 insertions, 0 deletions
diff --git a/static/openbsd/man5/acct.5 b/static/openbsd/man5/acct.5 new file mode 100644 index 00000000..82ea470b --- /dev/null +++ b/static/openbsd/man5/acct.5 @@ -0,0 +1,157 @@ +.\" $OpenBSD: acct.5,v 1.27 2024/02/25 00:07:14 deraadt Exp $ +.\" $NetBSD: acct.5,v 1.4 1995/10/22 01:40:10 ghudson Exp $ +.\" +.\" Copyright (c) 1991, 1993 +.\" The Regents of the University of California. All rights reserved. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" 3. Neither the name of the University nor the names of its contributors +.\" may be used to endorse or promote products derived from this software +.\" without specific prior written permission. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.\" @(#)acct.5 8.1 (Berkeley) 6/5/93 +.\" +.Dd $Mdocdate: February 25 2024 $ +.Dt ACCT 5 +.Os +.Sh NAME +.Nm acct +.Nd execution accounting file +.Sh SYNOPSIS +.In sys/acct.h +.Sh DESCRIPTION +The kernel maintains the following +.Fa acct +information structure for all +processes. +If a process terminates or misbehaves in specific ways, +and accounting is enabled, the kernel calls the +.Xr acct 2 +function call to prepare and append the record +to the accounting file. +.Bd -literal +/* + * Accounting structures; these use a comp_t type which is a 3 bits base 8 + * exponent, 13 bit fraction floating point number. Units are 1/AHZ + * seconds. + */ +typedef u_int16_t comp_t; + +struct acct { + char ac_comm[24]; /* command name, incl NUL */ + comp_t ac_utime; /* user time */ + comp_t ac_stime; /* system time */ + comp_t ac_etime; /* elapsed time */ + comp_t ac_io; /* count of IO blocks */ + time_t ac_btime; /* starting time */ + uid_t ac_uid; /* user id */ + gid_t ac_gid; /* group id */ + u_int32_t ac_mem; /* average memory usage */ + dev_t ac_tty; /* controlling tty, or -1 */ + pid_t ac_pid; /* process id */ + + u_int32_t ac_flag; /* accounting flags */ +#define AFORK 0x00000001 /* fork'd but not exec'd */ +#define AMAP 0x00000004 /* killed by syscall or stack mapping violation */ +#define ACORE 0x00000008 /* dumped core */ +#define AXSIG 0x00000010 /* killed by a signal */ +#define APLEDGE 0x00000020 /* killed due to pledge violation */ +#define ATRAP 0x00000040 /* memory access violation */ +#define AUNVEIL 0x00000080 /* unveil access violation */ +#define APINSYS 0x00000200 /* killed by syscall pin violation */ +#define ABTCFI 0x00000400 /* BT CFI violation */ +}; + +/* + * 1/AHZ is the granularity of the data encoded in the comp_t fields. + * This is not necessarily equal to hz. + */ +#define AHZ 64 + +#ifdef _KERNEL +int acct_process(struct proc *p); +int acct_shutdown(void); +#endif +.Ed +.Pp +If a terminated or misbehaving process was created by an +.Xr execve 2 , +the name of the executed file (at most ten characters of it) +is saved in the field +.Fa ac_comm +and its status is saved by setting one or more of the following flags in +.Fa ac_flag : +.Bl -tag -width "AUNVEIL" +.It Dv AFORK +A new process was created via +.Xr fork 2 +that was not followed by a call to +.Xr execve 2 . +.It Dv AMAP +The process terminated abnormally due to a system call or stack mapping +violation. +.It Dv ACORE +The process terminated abnormally due to a signal and dumped +.Xr core 5 . +.It Dv AXSIG +The process was killed by a +.Xr signal 3 . +.It Dv APLEDGE +The process was killed due to a +.Xr pledge 2 +violation. +.It Dv ATRAP +The process was killed due to a memory access violation +detected by a processor trap. +.It Dv AUNVEIL +The process attempted a file access that was prevented by +.Xr unveil 2 +restrictions. +Note that this does not cause the process to terminate. +.It Dv APINSYS +The command tried to execute a system call from the wrong +system call instruction, see +.Xr pinsyscalls 2 . +.It Dv ABTCFI +The command executed an indirect branch to a location that did not +start with a +.Ql BTI +instruction, and terminated with signal +.Dv SIGILL , +.Va code +.Dv ILL_BTCFI . +.El +.Sh SEE ALSO +.Xr lastcomm 1 , +.Xr acct 2 , +.Xr execve 2 , +.Xr pledge 2 , +.Xr unveil 2 , +.Xr signal 3 , +.Xr core 5 , +.Xr accton 8 , +.Xr sa 8 +.Sh HISTORY +An +.Nm +file format first appeared in +.At v7 . |
