ACCT(4)                              SysV                              ACCT(4)



NAME
     acct - per-process accounting file format

SYNOPSIS
     #include <sys/acct.h>

DESCRIPTION
     Files produced as a result of calling acct(2) have records in the form
     defined by <sys/acct.h>, whose contents are:

     typedef ushort comp_t;   /* "floating point" */
          /* 13-bit fraction, 3-bit exponent  */

     struct    acct
     {
       short   ac_flag;       /* Accounting flag */
       char    ac_stat;       /* Exit status */
       char    ac_fill1;      /* RESERVED */
       char    ac_sid[36];    /* RESERVED */
       ulong   ac_uid;        /* Accounting user ID */
       ulong   ac_gid;        /* Accounting group ID */
       ulong   ac_oid;        /* Accounting org ID */
       dev_t   ac_tty;        /* control typewriter *//* NOT USED */
       time_t  ac_btime;      /* Beginning time */
       comp_t  ac_utime;      /* acctng user time in clock ticks */
       comp_t  ac_stime;      /* acctng system time in clock ticks *//* NOT USED */
       comp_t  ac_etime;      /* acctng elapsed time in clock ticks */
       comp_t  ac_mem;        /* memory usage *//* NOT USED */
       comp_t  ac_io;         /* chars transferred *//* NOT USED */
       comp_t  ac_rw;         /* blocks read or written */
       comp_t  ac_net;        /* net blocks read or written */
       char    ac_exuid[8];   /* RESERVED */
       char    ac_comm[32];   /* command name */
       char    ac_fill2[14];  /* RESERVED */
     };

     #define AFORK  01   /* has executed fork, but no exec */
     #define ASU    02   /* used super-user privileges */
     #define ACCTF  0300 /* record type: 00 = acct */

     In ac_flag, the AFORK flag is turned on by each fork(2) and turned off by
     an exec(2).  The ac_comm field is inherited from the parent process and
     is reset by any exec.  Each time the system charges the process with a
     clock tick, it also adds to ac_mem the current process size, computed as
     follows:

          (data size) + (text size) / (number of in-core processes using text)

     The value of ac_mem/(ac_stime+ac_utime) can be viewed as an approximation
     to the mean process size, as modified by text sharing.

     The structure tacct.h, which resides with the source files of the
     accounting commands, represents the total accounting format used by the
     various accounting commands:

     /*
      *  total accounting (for acct period), also for day
      */

     struct tacct {
            uid_t          ta_uid;      /* userid */

            char           ta_name[8];  /* login name */
            float          ta_cpu[2];   /* cum. cpu time, p/np (mins) */
            float          ta_kcore[2]; /* cum kcore-minutes, p/np */
            float          ta_con[2];   /* cum. connect time, p/np, mins */
            float          ta_du;       /* cum. disk usage */
            long           ta_pc;       /* count of processes */
            unsigned short ta_sc;       /* count of login sessions */
            unsigned short ta_dc;       /* count of disk samples */
            unsigned short ta_fee;      /* fee for special services */
     };

SEE ALSO
     acct(2), exec(2), fork(2).
     acct(1M), acctcom(1).

BUGS
     The ac_mem value for a short-lived command gives little information about
     the actual size of the command, because ac_mem may be incremented while a
     different command (for example, the shell) is being executed by the
     process.