bsd进程记账

参考 http://blog.chinaunix.net/uid-26822401-id-3153147.html

似乎跟信号那有关系

记账记录的结构体定义在<sys/acct.h>头文件里，并看起来像：

typedef u_short comp_t;  /* 3-bit base 8 exponent; 13-bit fraction */
struct acct
{
  char ac_flag;  /* flag (see following Figure) */
  char ac_stat;  /* termination status (signal & core flag only) */ /* Solaris Only */
  uid_t ac_uid;  /* real user ID */
  gid_t ac_gid;  /*real group ID */
  dev_t ac_tty;  /* controlling terminal */
  time_t ac_btime; /* starting calendar time */
  comp_t ac_utime;  /* user CPU time (clock ticks) */
  comp_t ac_stime;  /* system CPU time (clock ticks) */
  comp_t ac_etime;  /* elapsed time (clock ticks) */
  comp_t ac_mem;  /* average memory usage */
  comp_t ac_io;  /* bytes transfered (by read and write) */ /* "blocks on BSD systems */
  comp_t ac_rw;  /* blocks read or written */  /* (not present on BSD systems) */
  char ac_comm[8];  /* command name: [8] for Solaris, [10] for Mac OS X, [16] for FreeBSD, and [17] for Linux */
}; 

#include <unistd.h>
#include <signal.h>

int
main(void)
{
    pid_t pid;

    if ((pid = fork()) < 0) {
        printf("fork error\n");
        exit(1);
    } else if (pid != 0) { /* parent */
        sleep(2);
        exit(2); /* terminate with exit status 2 */
    }
                        /* first child */
    if ((pid = fork()) < 0) {
        printf("fork error\n");
        exit(1);
    } else if (pid != 0) {
        sleep(4);
        abort(); /* terminate with core dump */
    }

                        /* second child */
    if ((pid = fork()) < 0) {
        printf("fork error\n");
        exit(1);
    } else if (pid != 0) {
        execl("/bin/dd", "dd", "if=/etc/termcap", "of=/dev/null", NULL);
        exit(7); /* shouldn't get here */
    }

                        /* third child */
    if ((pid = fork()) < 0) {
        printf("fork error\n");
        exit(1);
    } else if (pid != 0) {
        sleep(8);
        exit(0); /* normal exit */
    }

                        /* fourth child */
    sleep(6);
    kill(getpid(), SIGKILL); /* terminate w/signal, no core dump */
    exit(6); /* shouldn't get here */
}

#include <sys/acct.h>
#include <unistd.h>
#include <stdio.h>

#ifdef HAS_SA_STAT
#define FMT "%-*.*s e = %6ld, chars = %7ld, stat = %3u: %c %c %c %c\n"
#else
#define FMT "%-*.*s e = %6ld, chars = %7ld, %c %c %c %c\n"
#endif
#ifndef HAS_ACORE
#define ACORE 0
#endif
#ifndef HAS_AXSIG
#define AXSIG 0
#endif

static unsigned long
compt2ulong(comp_t comptime) /* convert comp_t to unsigend long */
{
    unsigned long val;
    int exp;

    val = comptime & 0x1fff; /* 13-bit fraction */
    exp = (comptime >> 13) & 7; /* 3-bit exponent (0-7) */
    while (exp-- > 0)
        val *= 8;
    return(val);
}
int
main(int argc, char *argv[])
{
    struct acct acdata;
    FILE *fp;

    if (argc != 2) {
        printf("usage: parcct filename\n");
        exit(1);
    }
    if ((fp = fopen(argv[1], "r")) == NULL) {
        printf("can't open %s\n", argv[1]);
        exit(1);
    }
    while (fread(&acdata, sizeof(acdata), 1, fp) == 1) {
        printf(FMT, (int)sizeof(acdata.ac_comm),
            (int)sizeof(acdata.ac_comm), acdata.ac_comm,
            compt2ulong(acdata.ac_etime), compt2ulong(acdata.ac_io),
#ifdef HAS_SA_STAT
            (unsigned char) acdata.ac_stat,
#endif
            acdata.ac_flag & ACORE ? 'D' : ' ',
            acdata.ac_flag & AXSIG ? 'X' : ' ',
            acdata.ac_flag & AFORK ? 'F' : ' ',
            acdata.ac_flag & ASU ? 'S' : ' ');
    }
    if (ferror(fp)) {
        printf("read error\n");
        exit(1);
    }
    exit(0);
}