acct(4)                                                      acct(4)


       NAME
             acct - per-process accounting file format

       SYNOPSIS
             #include <sys/types.h>
             #include <sys/acct.h>

       DESCRIPTION
             Files produced as a result of calling acct(2) have records in
             the form defined by sys/acct.h, whose contents are:

                typedef  ushort comp_t; /* "floating point" */
                                        /* 13-bit fraction, 3-bit exponent */
                struct      acct
                {
                   char   ac_flag;     /* Accounting flag */
                   char   ac_stat;     /* Exit status */
                   uid_t  ac_uid;      /* Accounting user ID */
                   gid_t  ac_gid;      /* Accounting group ID */
                   dev_t  ac_tty;      /* control typewriter */
                   time_t ac_btime;    /* Beginning time */
                   comp_t ac_utime;    /* acctng user time in clock ticks */
                   comp_t ac_stime;    /* acctng system time in clock ticks */
                   comp_t ac_etime;    /* acctng elapsed time in clock ticks */
                   comp_t ac_mem;      /* memory usage in clicks */
                   comp_t ac_io;       /* chars trnsfrd by read/write */
                   comp_t ac_rw;       /* number of block reads/writes */
                   char   ac_comm[8];  /* command name */
                };
                extern  struct  acct  acctbuf;
                extern  struct  vnode  *acctp;  /* vnode of accounting file */
                #define AFORK   01     /* has executed fork, but no exec */
                #define     ASU     02     /* used super-user privileges */
                #define     ACCTF   0300   /* record type: 00 = acct */
                #define     AEXPND  040    /* Expanded Record Type*/

             In ac_flag, the AFORK flag is turned on by each fork and
             turned off by an exec.  The ac_comm field is inherited from
             the parent process and is reset by any exec.  Each time the
             system charges the process with a clock tick, it also adds to
             ac_mem the current process size, computed as follows:
                   (data size) + (text size) / (number of in-core processes using text)

             The value of ac_mem/(ac_stime+ac_utime) can be viewed as an
             approximation to the mean process size, as modified by text
             sharing.


                           Copyright 1994 Novell, Inc.               Page 1

      acct(4)                                                      acct(4)


            The structure tacct, which resides with the source files of
            the accounting commands, represents the total accounting
            format used by the various accounting commands:

               /*
                *  total accounting (for acct period), also for day
                */
               struct  tacct {
                  uid_t          ta_uid;       /* userid */
                  char           ta_name[8];   /* login name */
                  float          ta_cpu[2];    /* cum. cpu time, p/np (mins) */
                  float          ta_kcore[2];  /* cum kcore-minutes, p/np */
                  float          ta_con[2];    /* cum. connect time, p/np, mins */
                  float          ta_du;        /* cum. disk usage */
                  long           ta_pc;        /* count of processes */
                  unsigned short ta_sc;        /* count of login sessions */
                  unsigned short ta_dc;        /* count of disk samples */
                  unsigned short ta_fee;       /* fee for special services */
               };

      REFERENCES
            acct(1M), acct(2), acctcom(1), exec(2), fork(2)

      NOTICES
            The ac_mem value for a short-lived command gives little
            information about the actual size of the command, because
            ac_mem may be incremented while a different command (for
            example, the shell) is being executed by the process.




















                          Copyright 1994 Novell, Inc.               Page 2