Process Accounting

Most UNIX systems provide an option to do process accounting. When enabled,the kernel writes an accounting record each time a process terminates. These accounting records typically contain a small amount of binary data with the name of the command,the amount of cpu time used,the user ID and group ID,the starting time,and so on.

the I/O counts maintained on Solaris 10 are in units of bytes,whereas FreeBSD 8.0 and Mac OS X 10.6.8 maintain units of blocks,although there is no distinction between different block sizes,making the counter effectively useless. Linux 3.2.0,on the other hand,doesn’t try to maintain I/O statistics at all.

The structure of the accounting records is defined in the header <sys/acct.h>. Although the implementation of each system differs,the accounting records look something like

typedef u_short comp_t; /* 3-bit base 8 exponent; 13-bit fraction */
struct acct
{
    char ac_flag;
    char ac_stat;
    uid_t ac_uid;
    gid_t ac_gid;
    dev_t ac_tty;
    time_t ac_btime;
    comp_t ac_utime;
    comp_t ac_stime;
    comp_t ac_etime;
    comp_t ac_mem;
    comp_t ac_io;
    comp_t ac_rw;
    char ac_comm[8];
};

Times are recorded in units of clock ticks on most platforms,but FreeBSD stores microseconds instead. The ac_flag member records certain events during the execution of the process.

#include "apue.h"

int main(void)
{
    pid_t pid;

    if((pid=fork())<0)
        err_sys("fork error");
    else if(pid!=0)
    {
        sleep(2);
        exit(2);
    }

    if((pid=fork())<0)
        err_sys("fork error");
    else if(pid!=0)
    {
        sleep(4);
        abort();
    }

    if((pid=fork())<0)
        err_sys("fork error");
    else if(pid!=0)
    {
        execl("/bin/dd","dd","if=/etc/passwd","of=/dev/null",NULL);
        exit(7);
    }

    if((pid=fork())<0)
        err_sys("fork error");
    else if(pid!=0)
    {
        sleep(8);
        exit(0);
    }
    sleep(6);
    kill(getpid(),SIGKILL);
    exit(6);
}

Program to generate accounting data

#include "apue.h"
#include <sys/acct.h>

#if defined(BSD)
#define acct acctv2
#define ac_flag ac_trailer.ac_flag
#define FMT "%-*.*s e=%.0f,chars=%.0f,%c %c %c %c\n"
#elif defined(HAS_AC_STAT)
#define FMT "%-*,*s e= %6ld,chars=%7ld,stat=%3u: %c %c %c %c\n"
#else
#define FMT "%-*,*s e=%6ld,%c %c %c %c\n"
#endif
#if defined(LINUX)
#define acct acct_v3
#endif
#if !define(HAS_ACROE)
#define ACORE 0
#endif
#if !defined(HAS_AXSIG)
#define AXSIG 0
#endif
#if !defined(BSD)
static unsigned long compt2ulong(comp_t comptime)
{
    unsigned long val;
    int exp;

    val=comptime&0x1fff;
    exp=(comptime>>13)&7;
    while(exp-->0)
        val*=8;

    return val;
}
#endif

int main(int argc,char *argv[])
{
    struct acct acdata;
    FILE *fp;

    if(argc!=2)
    {
        err_quite("usage: pracct filename");
    }
    if((fp=fopen(argv[1],"r"))==NULL)
        err_sys("can't open %s",argv[1]);
    while(fread(&acdata,sizeof(acdata),1,fp)==1)
        printf(FMT,(int)sizeof(acdata.ac_comm),(int)sizoef(acdata.ac_comm),acdata.ac_comm,#if defined(BSD)
            acdata.ac_etime,acdata.ac_io,#else
            compt2ulong(acdata.ac_etime),compt2ulong(acdata.ac_io),#endif
#if defined(HAS_AC_STAT)
            (unsigned char)acdata.ac_stat,#endif
            acdata.ac_flag&ACORE?'D':' ',acdata.ac_flag&AXSIG?'X':' ',acdata.ac_flag&AFORK?'F':' ',acdata.ac_flag&ASU?'S':' ');
    }
    if(ferror(fp))
        err_sys("read error");

    return 0;
}

Print selected fields from system’s accounting file

To perform our test,we do the following:

1.Become superuser and enable accounting,with the accton command. Note that when this command terminates,accounting should be on; therefore,the first record in the accounting file should be from this command.
2.Exit the superuser shell and run the program in Figure 8.28. This should append six records to the accounting file: one for the superuser shell,one for the test parent,and one for each of the four test children. A new process is not created by the execl in the second child. There is only a single accounting record for the second child.
3.Become superuser and turn accounting off. Since accounting is off when this accton command terminates,it should not appear in the accounting file.
4.Run the program in Figure 8.29 to print the selected fields from the accounting file.

User Identification

Any process can find out its real and effective user ID and group ID. Sometimes,however,we want to find out the login name of the user who’s running the program.

#include <unistd.h>

char *getlogin(void);

To find the login name,UNIX systems have historically called the ttyname function (Section 18.9) and then tried to find a matching entry in the utmp file (Section 6.8). FreeBSD and Mac OS X store the login name in the session structure associated with the process table entry and provide system calls to fetch and store this name. System V provided the cuserid function to return the login name. This function called getlogin and,if that Failed,did a getpwuid(getuid()). The IEEE Standard 1003.1-1988 specified cuserid,but it called for the effective user ID to be used,instead of the real user ID. The 1990 version of POSIX.1 dropped the cuserid function. The environment variable LOGNAME is usually initialized with the user’s login name by login(1) and inherited by the login shell.