ACCT(4) ACCT(4)
NAME
acct - per-process accounting file format
SYNOPSIS
#include <sys/acct.h>
DESCRIPTION
Files produced as a result of calling acct(2) have records
in the form defined by <sys/acct.h>, whose contents are:
typedef ushort comp_t; /* "floating point" */
/* 13-bit fraction, 3-bit exponent */
struct acct
{
char ac_flag; /* Accounting flag */
char ac_stat; /* Exit status */
ushort ac_uid; /* Accounting user ID */
ushort ac_gid; /* Accounting group ID */
dev_t ac_tty; /* control typewriter */
time_t ac_btime; /* Beginning time */
comp_t ac_utime; /* acctng user time in clock ticks */
comp_t ac_stime; /* acctng system time in clock ticks */
comp_t ac_etime; /* acctng elapsed time in clock ticks */
comp_t ac_mem; /* memory usage in clicks */
comp_t ac_io; /* chars trnsfrd by read/write */
comp_t ac_rw; /* number of block reads/writes */
char ac_comm[8]; /* command name */
};
extern struct acct acctbuf;
extern struct inode *acctp; /* inode of accounting file */
#define AFORK 01 /* has executed fork, but no exec */
#define ASU 02 /* used super-user privileges */
#define ACCTF 0300 /* record type: 00 = acct */
In ac_flag, the AFORK flag is turned on by each fork(2) and
turned off by an exec(2). The ac_comm field is inherited
from the parent process and is reset by any exec. Each time
Page 1 May 1989
ACCT(4) ACCT(4)
the system charges the process with a clock tick, it also
adds to ac_mem the current process size, computed as
follows:
(data size) + (text size) / (number of in-core
processes using text)
The value of ac_mem/(ac_stime+ac_utime) can be viewed as an
approximation to the mean process size, as modified by text
sharing.
The structure acct, which resides with the source files of
the accounting commands, represents the total accounting
format used by the various accounting commands:
/*
* total accounting (for acct period), also for day
*/
struct tacct {
uid_t ta_uid; /* userid */
char ta_name[8]; /* login name */
float ta_cpu[2]; /* cum. cpu time, p/np (mins) */
float ta_kcore[2]; /* cum kcore-minutes, p/np */
float ta_con[2]; /* cum. connect time, p/np, mins */
float ta_du; /* cum. disk usage */
long ta_pc; /* count of processes */
unsigned short ta_sc; /* count of login sessions */
unsigned short ta_dc; /* count of disk samples */
unsigned short ta_fee; /* fee for special services */
};
SEE ALSO
acct(2), exec(2), fork(2) in the Programmer's Reference
Manual.
acct(1M) in the System Administrator's Reference Manual.
acctcom(1) in the User's Reference Manual.
BUGS
The ac_mem value for a short-lived command gives little
Page 2 May 1989
ACCT(4) ACCT(4)
information about the actual size of the command, because
ac_mem may be incremented while a different command (e.g.,
the shell) is being executed by the process.
Page 3 May 1989