acct(4)                                                             acct(4)


   NAME
         acct - per-process accounting file format

   SYNOPSIS
         #include <sys/types.h>
         #include <sys/acct.h>

   DESCRIPTION
         Files produced as a result of calling acct(2) have records in the
         form defined by <sys/acct.h>, whose contents are:

         typedef  ushort compt; /* "floating point" */
                     /* 13-bit fraction, 3-bit exponent  */

         struct  acct
         {
                 char   acflag;    /* Accounting flag */
                 char   acstat;    /* Exit status */
                 uidt  acuid;     /* Accounting user ID */
                 gidt  acgid;     /* Accounting group ID */
                 devt  actty;     /* control typewriter */
                 timet acbtime;   /* Beginning time */
                 compt acutime;   /* acctng user time in clock ticks */
                 compt acstime;   /* acctng system time in clock ticks */
                 compt acetime;   /* acctng elapsed time in clock ticks */
                 compt acmem;     /* memory usage in clicks */
                 compt acio;      /* chars trnsfrd by read/write */
                 compt acrw;      /* number of block reads/writes */
                 char   accomm[8]; /* command name */
         };

         extern  struct acct        acctbuf;
         extern  struct vnode       *acctp;  /* vnode of accounting file */

         #define AFORK  01          /* has executed fork, but no exec */
         #define ASU    02          /* used super-user privileges */
         #define ACCTF  0300        /* record type: 00 = acct */
         #define AEXPND 040         /*Expanded Record Type*/

         In acflag, the AFORK flag is turned on by each fork and turned off
         by an exec.  The accomm field is inherited from the parent process
         and is reset by any exec.  Each time the system charges the process
         with a clock tick, it also adds to acmem the current process size,
         computed as follows:

               (data size) + (text size) / (number of in-core processes using
               text)

         The value of acmem/(acstime+acutime) can be viewed as an
         approximation to the mean process size, as modified by text sharing.



   7/91                                                                 Page 1

   acct(4)                                                             acct(4)


         The structure tacct, which resides with the source files of the
         accounting commands, represents the total accounting format used by
         the various accounting commands:

         /*
          *  total accounting (for acct period), also for day
          */

         struct tacct {
                uidt          tauid;      /* userid */
                char           taname[8];  /* login name */
                float          tacpu[2];   /* cum. cpu time, p/np (mins) */
                float          takcore[2]; /* cum kcore-minutes, p/np */
                float          tacon[2];   /* cum. connect time, p/np, mins */
                float          tadu;       /* cum. disk usage */
                long           tapc;       /* count of processes */
                unsigned short tasc;       /* count of login sessions */
                unsigned short tadc;       /* count of disk samples */
                unsigned short tafee;      /* fee for special services */
         };

   SEE ALSO
         acct(2), exec(2), fork(2).
         acct(1M) in the System Administrator's Reference Manual.
         acctcom(1) in the User's Reference Manual.

   NOTES
         The acmem value for a short-lived command gives little information
         about the actual size of the command, because acmem may be
         incremented while a different command (e.g., the shell) is being
         executed by the process.






















   Page 2                                                                 7/91