acct(4)                                                   acct(4)



     NAME
          acct - per-process accounting file format

     SYNOPSIS
          #include <sys/acct.h>

     DESCRIPTION
          Files produced as a result of calling acct(2) have records
          in the form defined by <sys/acct.h>, whose contents are:

          typedef ushort comp_t;  /* floating point */
                                  /* 13-bit fraction, 3-bit
                                      exponent */

          struct     acct {
             char    ac_flag;     /* Accounting flag */
             char    ac_stat;     /* Exit status */
             ushort  ac_uid;      /* Accounting user ID */
             ushort  ac_gid;      /* Accounting group ID */
             dev_t   ac_tty;      /* control typewriter */
             time_t  ac_btime;    /* Beginning time */
             comp_t  ac_utime;    /* acctng user time in
                                     clock ticks */
             comp_t  ac_stime;    /* acctng system time in
                                     clock ticks */
             comp_t  ac_etime;    /* acctng elapsed time in
                                     clock ticks */
             comp_t  ac_mem;      /* memory usage in clicks */
             comp_t  ac_io;       /* chars trnsfrd by read/write */
             comp_t  ac_rw;       /* number of block reads/writes */
             char    ac_comm[8];  /* command name */
          };

          extern   struct  acct  acctbuf;
          extern   struct  inode *acctp; /* inode of acctng file */

          #define  AFORK   01    /* has executed fork-no exec */
          #define  ASU     02    /* used super-user privileges */
          #define  ACCTF   0300  /* record type: 00 = acct */

          In acflag, the AFORK flag is turned on by each fork (2) and
          turned off by an exec (2). The accomm field is inherited
          from the parent process and is reset by any exec.  Each time
          the system charges the process with a clock tick, it also
          adds to acmem the current process size, computed as
          follows:

          (data size) + (text size) / (number of in-core processes
          using text)

          The value of acmem/(acstime+acutime) can be viewed as an
          approximation to the mean process size, as modified by



     Page 1                                        (last mod. 1/14/87)

     acct(4)                                                   acct(4)



          text-sharing.

          The structure tacct, which resides with the source files of
          the accounting commands, represents the total accounting
          format used by the various accounting commands:
          /*
          /* total accounting (for acct period), also for day
          /*
          struct tacct {
                uid_t           ta_uid;      /* userid */
                char            ta_name[8];  /* login name */
                float           ta_cpu[2];   /* cum. cpu time,
                                               p/np (mins) */
                float           ta_kcore[2]; /* cum kcore-minutes,
                                                p/np */
                float           ta_con[2];   /* cum. connect time,
                                                p/np, mins */
                float           ta_du;       /* cum. disk usage */
                long            ta_pc;       /* count of processes */
                unsigned short  ta_sc;       /* count of login
                                                sessions */
                unsigned short  ta_dc;       /* count of disk
                                                samples */
                unsigned short  ta_fee;      /* fee for special
                                                services */
          };

     SEE ALSO
          acct(1M), acctcom(1), acct(2), exec(2), fork(2).

     BUGS
          The acmem value for a short-lived command gives little
          information about the actual size of the command, because
          acmem may be incremented while a different command (e.g.,
          the shell) is being executed by the process.




















     Page 2                                        (last mod. 1/14/87)