How does Linux Process Accounting (psacct) work?

Question

I find a lot documents about psacct , but they are addressing usage, not how it works.

Question

I really want to know how process accounting works:

1. Which part of the system records information about processes?

2. How does it work?

Already done

I installed psacct on RHEL 6.5.

1. The service staring script actually (/etc/init.d/psacct) call this:

   /sbin/accton $ACCTFILE

2. The /sbin/accton calls system call acct()

man acct

DESCRIPTION The acct() system call enables or disables process accounting. If called with the name of an existing file as its argument, accounting is turned on, and records for each terminating process are appended to filename as it terminates. An argument of NULL causes accounting to be turned off.

Answer 1

The answer to your question is in the linux source file kernel/acct.c . Particularly in the fill_ac function

/*
 *  Write an accounting entry for an exiting process
 *
 *  The acct_process() call is the workhorse of the process
 *  accounting system. The struct acct is built here and then written
 *  into the accounting file. This function should only be called from
 *  do_exit() or when switching to a different output file.
 */

static void fill_ac(acct_t *ac)