ACCT(4)                                                   ACCT(4)



     NAME
          acct - per-process accounting file format

     SYNOPSIS
          #include <sys/acct.h>

     DESCRIPTION
          Files produced as a result of calling acct(2) have records
          in the form defined by <sys/acct.h>, whose contents are:

          typedef  ushort comp_t;  /* "floating point" */
                    /* 13-bit fraction, 3-bit exponent  */

          struct  acct
          {
                  char   ac_flag;    /* Accounting flag */
                  char   ac_stat;    /* Exit status */
                  ushort ac_uid;
                  ushort ac_gid;
                  dev_t  ac_tty;
                  time_t ac_btime;   /* Beginning time */
                  comp_t ac_utime;   /* acctng user time in clock ticks */
                  comp_t ac_stime;   /* acctng system time in clock ticks */
                  comp_t ac_etime;   /* acctng elapsed time in clock ticks */
                  comp_t ac_mem;     /* memory usage in clicks */
                  comp_t ac_io;      /* chars trnsfrd by read/write */
                  comp_t ac_rw;      /* number of block reads/writes */
                  char   ac_comm[8]; /* command name */
          };

          extern  struct acct        acctbuf;
          extern  struct inode       *acctp;  /* inode of accounting file */

          #define AFORK  01          /* has executed fork, but no exec */
          #define ASU    02          /* used super-user privileges */
          #define ACCTF  0300        /* record type: 00 = acct */

          In ac_flag, the AFORK flag is turned on by each fork(2) and
          turned off by an exec(2).  The ac_comm field is inherited
          from the parent process and is reset by any exec.  Each time
          the system charges the process with a clock tick, it also
          adds to ac_mem the current process size, computed as
          follows:

               (data size) + (text size) / (number of in-core
               processes using text)

          The value of ac_mem/(ac_stime+ac_utime) can be viewed as an
          approximation to the mean process size, as modified by
          text-sharing.





     Page 1                                        (last mod. 8/20/87)

     ACCT(4)                                                   ACCT(4)



          The structure tacct.h, which resides with the source files
          of the accounting commands, represents the total accounting
          format used by the various accounting commands:

          /*
           *  total accounting (for acct period), also for day
           */

          struct tacct {
                 uid_t          ta_uid;      /* userid */
                 char           ta_name[8];  /* login name */
                 float          ta_cpu[2];   /* cum. cpu time, p/np (mins) */
                 float          ta_kcore[2]; /* cum kcore-minutes, p/np */
                 float          ta_con[2];   /* cum. connect time, p/np, mins */
                 float          ta_du;       /* cum. disk usage */
                 long           ta_pc;       /* count of processes */
                 unsigned short ta_sc;       /* count of login sessions */
                 unsigned short ta_dc;       /* count of disk samples */
                 unsigned short ta_fee;      /* fee for special services */
          };

     SEE ALSO
          acct(2), exec(2), fork(2).

     BUGS
          The ac_mem value for a short-lived command gives little
          information about the actual size of the command, because
          ac_mem may be incremented while a different command (e.g.,
          the shell) is being executed by the process.

     ORIGIN
          AT&T V.3























     Page 2                                        (last mod. 8/20/87)