acct(4)                                                   acct(4)



NAME
     acct - per-process accounting file format

SYNOPSIS
     #include <sys/acct.h>

DESCRIPTION
     Files produced as a result of calling acct(2) have records
     in the form defined by <sys/acct.h>, whose contents are

        typedef ushort comp_t;  /* floating point */
                                /* 13-bit fraction, 3-bit
                                    exponent */

        struct     acct {
           char    ac_flag;     /* Accounting flag */
           char    ac_stat;     /* Exit status */
           ushort  ac_uid;      /* Accounting user ID */
           ushort  ac_gid;      /* Accounting group ID */
           dev_t   ac_tty;      /* control terminal */
           time_t  ac_btime;    /* Beginning time */
           comp_t  ac_utime;    /* acctng user time in
                                   clock ticks */
           comp_t  ac_stime;    /* acctng system time in
                                   clock ticks */
           comp_t  ac_etime;    /* acctng elapsed time in
                                   clock ticks */
           comp_t  ac_mem;      /* memory usage in clicks */
           comp_t  ac_io;       /* chars trnsfrd by read/write */
           comp_t  ac_rw;       /* number of block reads/writes */
           char    ac_comm[8];  /* command name */
        };

        extern   struct  acct  acctbuf;
        extern   struct  vnode *acctp; /* vnode of acctng file */

        #define  AFORK   01    /* has executed fork-no exec */
        #define  ASU     02    /* used superuser privileges */
        #define  ACCTF   0300  /* record type: 00 = acct */

     In ac_flag, the AFORK flag is turned on by each fork(2) and
     turned off by an exec(2).  The ac_comm field is inherited
     from the parent process and is reset by any exec.  Each time
     the system charges the process with a clock tick, it also
     adds the current process size to ac_mem, computed as
     follows:

     (data size) + (text size) / (number of in-core processes
     using text)

     The value of ac_mem/(ac_stime+ac_utime) can be viewed as an
     approximation to the mean process size, as modified by text



January 1992                                                    1

acct(4)                                                   acct(4)



     sharing.

     The structure tacct, which resides with the source files of
     the accounting commands, represents the total accounting
     format used by the various accounting commands.

        /*
        /* total accounting (for acct period), also for day
        /*

        struct tacct {
              uid_t           ta_uid;      /* userid */
              char            ta_name[8];  /* login name */
              float           ta_cpu[2];   /* cum. cpu time,
                                             p/np (mins) */
              float           ta_kcore[2]; /* cum kcore-minutes,
                                              p/np */
              float           ta_con[2];   /* cum. connect time,
                                              p/np, mins */
              float           ta_du;       /* cum. disk usage */
              long            ta_pc;       /* count of processes */
              unsigned short  ta_sc;       /* count of login
                                              sessions */
              unsigned short  ta_dc;       /* count of disk
                                              samples */
              unsigned short  ta_fee;      /* fee for special
                                              services */
        };


LIMITATIONS
     The ac_mem value for a short-lived command gives little
     information about the actual size of the command, because
     ac_mem may be incremented while a different command (for
     example, the shell) is being executed by the process.

SEE ALSO
     acct(2), exec(2), fork(2)

     acct(1M), acctcom(1M) in A/UX System Administrator's
     Reference














2                                                    January 1992