Support for Multiple Accounting File Formats under Linux

The detailed format of the acct file written by the Linux kernel varies depending on the kernel's version and configuration: Linux kernels 2.6.7 and earlier write a v0 format acct file which unfortunately cannot store user and group ids (uid/gid) larger than 65535. Kernels 2.6.8 and later write the acct file in v1, v2 or v3 formats. (v3 if BSD_PROCESS_ACCT_V3 is selected in the kernel configuration, otherwise v1 if on the m68k architecture or v2 everywhere else).

Since version 6.4 the GNU accounting utilities on Linux systems are able to read all of the v0, v2 and v3 file formats (v1 is not supported). Thus you do not need to worry about the details given above. You can even read acct files where different records were written by differently configured kernels (you can find out about the format of each entry by using the dump-acct utility). In case you ever need to convert an acct file to a different format, the --raw option of dump-acct does that together with the new --format and --byteswap options that determine format and byte order of the output file.

Multiformat support under Linux is intended to be a temporary solution to aid in switching to the v3 acct file format. So do not expect GNU acct 6.7 to still contain Multiformat support. In a few years time, when everybody uses the v3 format, the ability to read multiple formats at runtime will probably be dropped again from the GNU accounting utilities. This does not, however, affect the ability to adapt to the acct file format at compile time (when ./configure is run). Even GNU acct 6.3.5 (that does not know about multiple file formats) will yield working binary programs when compiled under a (as yet hypothetical) Linux kernel 2.6.62 that is only able to write the v3 format.

This document was generated on February, 6 2010 using texi2html 1.76.