acct(4) acct(4)
NAME
acct - per-process accounting file format
SYNOPSIS
#include <sys/types.h>
#include <sys/acct.h>
DESCRIPTION
Files produced as a result of calling acct(2) have records in the form
defined by sys/acct.h, whose contents are:
typedef ushortt compt; /* "floating point" */
/* 13-bit fraction, 3-bit exponent */
struct acct
{
char acflag; /* Accounting flag */
char acstat; /* Exit status */
uidt acuid; /* Accounting user ID */
gidt acgid; /* Accounting group ID */
devt actty; /* control typewriter */
timet acbtime; /* Beginning time */
compt acutime; /* acctng user time in clock ticks */
compt acstime; /* acctng system time in clock ticks */
compt acetime; /* acctng elapsed time in clock ticks */
compt acmem; /* memory usage in clicks */
compt acio; /* chars trnsfrd by read/write */
compt acrw; /* number of block reads/writes */
char accomm[8]; /* command name */
};
#define AFORK 01 /* has executed fork, but no exec */
#define ASU 02 /* used super-user privileges */
#define ACCTF 0300 /* record type: 00 = acct */
#define AEXPND 040 /* Expanded Record Type*/
In acflag, the AFORK flag is turned on by each fork and turned off by an
exec. The accomm field is inherited from the parent process and is
reset by any exec. Each time the system charges the process with a clock
tick, it also adds to acmem the current resident process size (see ps(1)
for a description of resident size). This consists of all valid pages
for a process, regardless of sharing.
The value of acmem/(acstime+acutime) can be viewed as an approximation
to the mean process size.
The structure tacct, which resides with the source files of the
accounting commands, represents the total accounting format used by the
various accounting commands:
/*
* total accounting (for acct period), also for day
*/
Page 1
acct(4) acct(4)
struct tacct {
uidt tauid; /* userid */
char taname[8]; /* login name */
float tacpu[2]; /* cum. cpu time, p/np (mins) */
float takcore[2]; /* cum kcore-minutes, p/np */
float tacon[2]; /* cum. connect time, p/np, mins */
float tadu; /* cum. disk usage */
long tapc; /* count of processes */
unsigned short tasc; /* count of login sessions */
unsigned short tadc; /* count of disk samples */
unsigned short tafee; /* fee for special services */
};
REFERENCES
acct(1M), acct(2), acctcom(1), exec(2), fork(2)
NOTICES
The acmem value for a short-lived command gives little information about
the actual size of the command, because acmem may be incremented while a
different command (for example, the shell) is being executed by the
process.
Page 2