acct(4)                          UNIX System V                          acct(4)


NAME
      acct - per-process accounting file format

SYNOPSIS
      #include <sys/types.h>
      #include <sys/acct.h>

DESCRIPTION
      Files produced as a result of calling acct(2) have records in the form
      defined by <sys/acct.h>, whose contents are:

      typedef  ushort compt; /* "floating point" */
                  /* 13-bit fraction, 3-bit exponent  */

      struct  acct
      {
              char   acflag;    /* Accounting flag */
              char   acstat;    /* Exit status */
              uidt  acuid;     /* Accounting user ID */
              gidt  acgid;     /* Accounting group ID */
              devt  actty;     /* control typewriter */
              timet acbtime;   /* Beginning time */
              compt acutime;   /* acctng user time in clock ticks */
              compt acstime;   /* acctng system time in clock ticks */
              compt acetime;   /* acctng elapsed time in clock ticks */
              compt acmem;     /* memory usage in clicks */
              compt acio;      /* chars trnsfrd by read/write */
              compt acrw;      /* number of block reads/writes */
              char   accomm[8]; /* command name */
      };

      extern  struct acct        acctbuf;
      extern  struct vnode       *acctp;  /* vnode of accounting file */

      #define AFORK  01          /* has executed fork, but no exec */
      #define ASU    02          /* used super-user privileges */
      #define ACCTF  0300        /* record type: 00 = acct */
      #define AEXPND 040         /*Expanded Record Type*/

      In acflag, the AFORK flag is turned on by each fork and turned off by an
      exec.  The accomm field is inherited from the parent process and is
      reset by any exec.  Each time the system charges the process with a clock
      tick, it also adds to acmem the current process size, computed as
      follows:

            (data size) + (text size) / (number of in-core processes using
            text)

      The value of acmem/(acstime+acutime) can be viewed as an approximation
      to the mean process size, as modified by text sharing.




10/89                                                                    Page 1

acct(4)                          UNIX System V                          acct(4)


      The structure tacct, which resides with the source files of the
      accounting commands, represents the total accounting format used by the
      various accounting commands:

      /*
       *  total accounting (for acct period), also for day
       */

      struct tacct {
             uidt          tauid;      /* userid */
             char           taname[8];  /* login name */
             float          tacpu[2];   /* cum. cpu time, p/np (mins) */
             float          takcore[2]; /* cum kcore-minutes, p/np */
             float          tacon[2];   /* cum. connect time, p/np, mins */
             float          tadu;       /* cum. disk usage */
             long           tapc;       /* count of processes */
             unsigned short tasc;       /* count of login sessions */
             unsigned short tadc;       /* count of disk samples */
             unsigned short tafee;      /* fee for special services */
      };

SEE ALSO
      acct(2), exec(2), fork(2)
      acct(1M) in the System Administrator's Reference Manual
      acctcom(1) in the User's Reference Manual

NOTES
      The acmem value for a short-lived command gives little information about
      the actual size of the command, because acmem may be incremented while a
      different command (for example, the shell) is being executed by the
      process.























Page 2                                                                    10/89