---
name: "acct"
section: "5"
platform: "openbsd"
package: "man"
version: "8.0-current-20261101"
release: "OpenBSD 8.0-current (2026-11-01)"
platforms: ["linux", "freebsd", "openbsd", "macos"]
url: "https://new.carta.tech/acct/5"
---

# acct(5)

execution accounting file

## NAME

**acct** – execution accounting file

## SYNOPSIS

**#include \<sys/acct.h\>**

## DESCRIPTION

The kernel maintains the following *acct* information structure for all processes. If a process terminates or misbehaves in specific ways, and accounting is enabled, the kernel calls the [acct(2)](/acct/2.md) function call to prepare and append the record to the accounting file.

```
/*
 * Accounting structures; these use a comp_t type which is a 3 bits base 8
 * exponent, 13 bit fraction floating point number.  Units are 1/AHZ
 * seconds.
 */
typedef u_int16_t comp_t;
struct acct {
	char	  ac_comm[24];	/* command name, incl NUL */
	comp_t	  ac_utime;	/* user time */
	comp_t	  ac_stime;	/* system time */
	comp_t	  ac_etime;	/* elapsed time */
	comp_t	  ac_io;	/* count of IO blocks */
	time_t	  ac_btime;	/* starting time */
	uid_t	  ac_uid;	/* user id */
	gid_t	  ac_gid;	/* group id */
	u_int32_t ac_mem;	/* average memory usage */
	dev_t	  ac_tty;	/* controlling tty, or -1 */
	pid_t	  ac_pid;	/* process id */
	u_int32_t ac_flag;	/* accounting flags */
#define	AFORK	0x00000001	/* fork'd but not exec'd */
#define	AMAP	0x00000004	/* killed by syscall or stack mapping violation */
#define	ACORE	0x00000008	/* dumped core */
#define	AXSIG	0x00000010	/* killed by a signal */
#define	APLEDGE	0x00000020	/* killed due to pledge violation */
#define	ATRAP	0x00000040	/* memory access violation */
#define	AUNVEIL	0x00000080	/* unveil access violation */
#define APINSYS 0x00000200      /* killed by syscall pin violation */
#define ABTCFI  0x00000400      /* BT CFI violation */
};
/*
 * 1/AHZ is the granularity of the data encoded in the comp_t fields.
 * This is not necessarily equal to hz.
 */
#define	AHZ	64
#ifdef _KERNEL
int	acct_process(struct proc *p);
int	acct_shutdown(void);
#endif
```

If a terminated or misbehaving process was created by an [execve(2)](/execve/2.md), the name of the executed file (at most ten characters of it) is saved in the field *ac\_comm* and its status is saved by setting one or more of the following flags in *ac\_flag*:

- AFORK

  A new process was created via [fork(2)](/fork/2.md) that was not followed by a call to [execve(2)](/execve/2.md).

- AMAP

  The process terminated abnormally due to a system call or stack mapping violation.

- ACORE

  The process terminated abnormally due to a signal and dumped [core(5)](/core/5.md).

- AXSIG

  The process was killed by a [signal(3)](/signal/3.md).

- APLEDGE

  The process was killed due to a pledge(2) violation.

- ATRAP

  The process was killed due to a memory access violation detected by a processor trap.

- AUNVEIL

  The process attempted a file access that was prevented by unveil(2) restrictions. Note that this does not cause the process to terminate.

- APINSYS

  The command tried to execute a system call from the wrong system call instruction, see pinsyscalls(2).

- ABTCFI

  The command executed an indirect branch to a location that did not start with a ‘BTI’ instruction, and terminated with signal SIGILL, *code* ILL\_BTCFI.

## SEE ALSO

[lastcomm(1)](/lastcomm/1.md), [acct(2)](/acct/2.md), [execve(2)](/execve/2.md), pledge(2), unveil(2), [signal(3)](/signal/3.md), [core(5)](/core/5.md), [accton(8)](/accton/8.md), [sa(8)](/sa/8.md)

## HISTORY

An **acct** file format first appeared in Version 7 AT&T UNIX.