acct(4)                                                             acct(4)

NAME
     acct - per-process accounting file format

SYNOPSIS
     #include <sys/types.h>

     #include <sys/acct.h>

DESCRIPTION
     Files produced as a result of calling acct(2) have records in the form
     defined by <sys/acct.h>, whose contents are:

          typedef ushort compt;        /* "floating point" */
                                        /* 13-bit fraction, 3-bit exponent  */
          struct acct
          {
              char   acflag;           /* Accounting flag */
              char   acstat;           /* Exit status */
              uidt  acuid;            /* Accounting user ID */
              gidt  acgid;            /* Accounting group ID */
              devt  actty;            /* control typewriter */
              timet acbtime;          /* Beginning time */
              compt acutime;          /* acctng user time in clock ticks */
              compt acstime;          /* acctng system time in clock ticks */
              compt acetime;          /* acctng elapsed time in clock ticks */
              compt acmem;            /* memory usage in clicks */
              compt acio;             /* chars trnsfrd by read/write */
              compt acrw;             /* number of block reads/writes */
              char   accomm[8];        /* command name */
          };
          extern struct acct  acctbuf;
          extern struct vnode *acctp;   /* vnode of accounting file */
          #define AFORK   01            /* has executed fork, but no exec */
          #define ASU     02            /* used superuser privileges */
          #define ACCTF   0300          /* record type: 00 = acct */
          #define AEXPND  040           /* Expanded Record Type*/

     In acflag, the AFORK flag is turned on by each fork and turned off by
     an exec. The accomm field is inherited from the parent process and is
     reset by any exec. Each time the system charges the process with a
     clock tick, it also adds to acmem the current process size, computed
     as follows:

          (data size) + (text size) / (number of in-core processes using
          text)

     The value of acmem/(acstime+acutime) can be viewed as an approxima-
     tion to the mean process size, as modified by text sharing.







Page 1                       Reliant UNIX 5.44                Printed 11/98

acct(4)                                                             acct(4)

NOTES
     The acmem value for a short-lived command gives little information
     about the actual size of the command, because acmem may be incre-
     mented while a different command (e.g. the shell) is being executed by
     the process.

SEE ALSO
     acctcom(1), acct(1M), acct(2), exec(2), fork(2).














































Page 2                       Reliant UNIX 5.44                Printed 11/98