acct(4)                             CLIX                             acct(4)



  NAME

    acct - Per-process accounting file format

  DESCRIPTION

    Files produced as a result of calling the acct() function have records in
    the form defined by the <sys/acct.h> header file, which has the following
    contents:

    typedef  ushort comp_t;  /* "floating-point" */
              /* 13-bit fraction, 3-bit exponent   */

    struct acct {
         char   ac_flag;    /* Accounting flag */
         char   ac_stat;    /* Exit status */
         ushort ac_uid;     /* Accounting user ID */
         ushort ac_gid;     /* Accounting group ID */
         dev_t  ac_tty;     /* control typewriter */
         time_t ac_btime;   /* Beginning time */
         comp_t ac_utime;   /* acctng user time in clock ticks */
         comp_t ac_stime;   /* acctng system time in clock ticks */
         comp_t ac_etime;   /* acctng elapsed time in clock ticks */
         comp_t ac_mem;     /* memory usage in clicks */
         comp_t ac_io;      /* chars trnsfrd by read/write */
         comp_t ac_rw;      /* number of block reads/writes */
         char   ac_comm[8]; /* command name */
    };

    extern  struct acct  acctbuf;
    extern  struct inode *acctp;  /* inode of accting file */

    #define AFORK    01     /* has executed fork, but no exec */
    #define ASU      02     /* used superuser privileges */
    #define ACCTF    0300   /* record type: 00 = acct */

    In ac_flag, the AFORK flag is set on by each fork() function, and turned
    off using the exec() function.  The ac_comm field is inherited from the
    parent process and is reset by any exec() function.  Each time the system
    charges the process with a clock tick, it also adds to ac_mem the current
    process size, computed as follows:

    (data size) + (text size) / (number of in-core processes using text)

    The value of ac_mem/(ac_stime+ac_utime) can be viewed as an approximation
    to the mean process size, as modified by text sharing.

    The acct structure, which resides with the source files of the accounting
    commands, represents the total accounting format used by the various
    accounting commands:




  2/94 - Intergraph Corporation                                              1

  acct(4)                             CLIX                             acct(4)



    /*
     *  total accounting (for acct period), also for day
     */

    struct tacct {
         uid_t          ta_uid;      /* user ID */
         char           ta_name[8];  /* login name */
         float          ta_cpu[2];   /* cum. cpu time, p/np (mins) */
         float          ta_kcore[2]; /* cum kcore-minutes, p/np */
         float          ta_con[2];   /* cum. conn. time, p/np, mins */
         float          ta_du;       /* cum. disk usage */
         long           ta_pc;       /* count of processes*/
         unsigned short ta_sc;       /* count of login sessions */
         unsigned short ta_dc;       /* count of disk samples */
         unsigned short ta_fee;      /* fee for special services */
    };


  CAUTIONS

    The ac_mem value for a short-lived command gives little information about
    the actual size of the command, because ac_mem may be incremented while a
    different command (for example, the shell) is being executed by the
    process.

  RELATED INFORMATION

    Commands:  acctcom(8), acct(8)

    Functions: acct(2), exec(2), fork(2)
























  2                                              Intergraph Corporation - 2/94