acct(4)

NAME

acct − per-process accounting file format

SYNOPSIS

#include <sys/acct.h>

DESCRIPTION

Files produced as a result of calling acct(2) have records in the form defined by <sys/acct.h>, whose contents are:

typedefushort comp_t;/∗ "floating point" ∗/
/∗ 13-bit fraction, 3-bit exponent ∗/
structacct
{
     char    ac_flag; /∗ Accounting flag ∗/
     char    ac_stat; /∗ Exit status ∗/
     ushort ac_uid; /∗ Accounting user ID ∗/
     ushort ac_gid; /∗ Accounting group ID ∗/
     dev_t   ac_tty; /∗ control typewriter ∗/
     time_t ac_btime; /∗ Beginning time ∗/
     comp_t ac_utime; /∗ acctng user time in clock ticks ∗/
     comp_t ac_stime; /∗ acctng system time in clock ticks ∗/
     comp_t ac_etime; /∗ acctng elapsed time in clock ticks ∗/
     comp_t ac_mem; /∗ memory usage in clicks ∗/
     comp_t ac_io; /∗ chars trnsfrd by read/write ∗/
     comp_t ac_rw; /∗ number of block reads/writes ∗/
     char    ac_comm[8]; /∗ command name ∗/
};
#define AFORK0001     /∗ has executed fork, but no exec ∗/
#define ASU0002     /∗ used super-user privileges ∗/
#define ACOMPAT 0004     /∗ used compatibility mode ∗/
#define ACORE0010     /∗ dumped core ∗/
#define AXSIG0020     /∗ killed by a signal ∗/
#define ACCTF0300     /∗ record type: 00 = acct ∗/

In ac_flag, the AFORK flag is turned on by each fork(2) and turned off by an exec(2). The ac_comm field is inherited from the parent process and is reset by any exec. Each time the system charges the process with a clock tick, it also adds to ac_mem the current process size, computed as follows:

(data size) + (text size) / (number of in-core processes using text)

The value of ac_mem/(ac_stime+ac_utime) can be viewed as an approximation to the mean process size, as modified by text-sharing.

The structure tacct.h, which resides with the source files of the accounting commands, represents the total accounting format used by the various accounting commands:

/∗
∗ total accounting (for acct period), also for day
∗/
struct tacct {
     uid_t     ta_uid;/∗ userid ∗/
     char      ta_name[8]; /∗ login name ∗/
     float     ta_cpu[2];/∗ cum. cpu time, p/np (mins) ∗/
     float     ta_kcore[2]; /∗ cum kcore-minutes, p/np ∗/
     float     ta_con[2];/∗ cum. connect time, p/np, mins ∗/
     float     ta_du;/∗ cum. disk usage ∗/
     long      ta_pc;/∗ count of processes ∗/
     unsigned short ta_sc; /∗ count of login sessions ∗/
     unsigned short ta_dc; /∗ count of disk samples ∗/
     unsigned short ta_fee; /∗ fee for special services ∗/
};

NOTES

The structure documented above is the AT&T SYSV.2 version of acct. The 4.2BSD structure is a subset of the one above. Also, in 4.2BSD, the units for the ac_utime, ac_stime, and ac_etime fields are seconds rather than clock ticks. CX/UX uses the AT&T SYSV.2 structure.

If the high resolution timing facility is configured into the currently executing kernel, ac_stime will exclude or include time spent servicing interrupts, depending on what the system timing mode is set to. See hirestmode(2) and CX/UX Programmer’s Guide for more information on the high resolution timing facility.

BUGS

The ac_mem value for a short-lived command gives little information about the actual size of the command, because ac_mem may be incremented while a different command (e.g., the shell) is being executed by the process.

CX/UX Programmer’s Reference Manual

Museum