acct(4)                   FILE FORMATS                    acct(4)



NAME
     acct - per-process accounting file format

SYNOPSIS
     #include <sys/types.h>
     #include <sys/acct.h>

DESCRIPTION
     Files produced as a result of calling acct(2)  have  records
     in the form defined by <sys/acct.h>, whose contents are:

     typedef  ushort compt;  /* "floating point" */
               /* 13-bit fraction, 3-bit exponent  */
     struct  acct
     {
             char   acflag;    /* Accounting flag */
             char   acstat;    /* Exit status */
             uidt  acuid;     /* Accounting user ID */
             gidt  acgid;     /* Accounting group ID */
             devt  actty;     /* control typewriter */
             timet acbtime;   /* Beginning time */
             compt acutime;   /* acctng user time in clock ticks */
             compt acstime;   /* acctng system time in clock ticks */
             compt acetime;   /* acctng elapsed time in clock ticks */
             compt acmem;     /* memory usage in clicks */
             compt acio;      /* chars trnsfrd by read/write */
             compt acrw;      /* number of block reads/writes */
             char   accomm[8]; /* command name */
     };

     extern  struct acct        acctbuf;
     extern  struct vnode       *acctp;  /* vnode of accounting file */

     #define AFORK  01          /* has executed fork, but no exec */
     #define ASU    02          /* used super-user privileges */
     #define ACCTF  0300        /* record type: 00 = acct */
     #define AEXPND 040         /*Expanded Record Type*/

     In acflag, the AFORK flag is turned on  by  each  fork  and
     turned  off by an exec.  The accomm field is inherited from
     the parent process and is reset by any exec.  Each time  the
     system  charges  the process with a clock tick, it also adds
     to acmem the current process size, computed as follows:

          (data  size)  +  (text  size)  /  (number  of   in-core
          processes using text)

     The value of acmem/(acstime+acutime) can be viewed as  an
     approximation  to the mean process size, as modified by text
     sharing.





                                                                1

acct(4)                   FILE FORMATS                    acct(4)



     The structure tacct, which resides with the source files  of
     the  accounting  commands,  represents  the total accounting
     format used by the various accounting commands:

     /*
      *  total accounting (for acct period), also for day
      */

     struct tacct {
            uidt          tauid;      /* userid */
            char           taname[8];  /* login name */
            float          tacpu[2];   /* cum. cpu time, p/np (mins) */
            float          takcore[2]; /* cum kcore-minutes, p/np */
            float          tacon[2];   /* cum. connect time, p/np, mins */
            float          tadu;       /* cum. disk usage */
            long           tapc;       /* count of processes */
            unsigned short tasc;       /* count of login sessions */
            unsigned short tadc;       /* count of disk samples */
            unsigned short tafee;      /* fee for special services */
     };

SEE ALSO
     acct(2), exec(2), fork(2).
     acct(1M) in the System Administrator's Reference Manual.
     acctcom(1) in the User's Reference Manual.

NOTES
     The acmem value for  a  short-lived  command  gives  little
     information  about  the  actual size of the command, because
     acmem may be incremented while a different  command  (e.g.,
     the shell) is being executed by the process.
























                                                                2