ACCT(2) | System Calls Manual | ACCT(2)

# NAME

`acct` — enable or disable process accounting

# SYNOPSIS

`#include <unistd.h>`

int
`acct`(const char *file);

# DESCRIPTION

The `acct`() call enables or disables the collection of system accounting records. If file is `NULL`, accounting is disabled. If file is an existing, NUL-terminated pathname, record collection is enabled. For every process initiated which terminates under normal conditions or misbehaves in very specific ways (e.g. file access prevented by unveil), an accounting record is appended to file. Abnormal conditions of termination are reboots or other fatal system problems. `acct`() is only available on kernels compiled with the `ACCOUNTING` option.

For more information on the record structure used by `acct`(), see /usr/include/sys/acct.h and acct(5).

This call is permitted only to the superuser.

# NOTES

Accounting is automatically disabled when the file system the accounting file resides on runs out of space; it is enabled when space once again becomes available.

# RETURN VALUES

Upon successful completion, the value 0 is returned; otherwise the value -1 is returned and the global variable errno is set to indicate the error.

# ERRORS

`acct`() will fail if one of the following is true:

[`EPERM`]
  The caller is not the superuser.
[`ENOTDIR`]
  A component of the path prefix is not a directory.
[`ENAMETOOLONG`]
  A component of a pathname exceeded `NAME_MAX` characters, or an entire pathname (including the terminating NUL) exceeded `PATH_MAX` bytes.
[`ENOENT`]
  The named file does not exist.
[`EACCES`]
  Search permission is denied for a component of the path prefix, or the pathname is not a regular file.
[`ELOOP`]
  Too many symbolic links were encountered in translating the pathname.
[`EROFS`]
  The named file resides on a read-only file system.
[`EFAULT`]
  file points outside the process's allocated address space.
[`EIO`]
  An I/O error occurred while reading from or writing to the file system.

# SEE ALSO

acct(5), accton(8), sa(8)

# HISTORY

An `acct`() function call appeared in Version 7 AT&T UNIX.

January 3, 2021 | Debian