acct(4)                                                             acct(4)




 NAME    [Toc]    [Back]
      acct - per-process accounting file format

 SYNOPSIS    [Toc]    [Back]
      #include <sys/acct.h>

 DESCRIPTION    [Toc]    [Back]
      Files produced as a result of calling acct() (see acct(2)) have
      records in the form defined by <sys/acct.h>, whose contents are:

           typedef ushort comp_t; /* "floating point":
                                          13-bit fraction, 3-bit exponent */
           struct  acct {
               char    ac_flag;        /* Accounting flag */
               char    ac_stat;        /* Exit status */
               uid_t   ac_uid;         /* Accounting user ID */
               gid_t   ac_gid;         /* Accounting group ID */
               dev_t   ac_tty;         /* control typewriter */
               time_t  ac_btime;       /* Beginning time */
               comp_t  ac_utime;       /* acctng user time in clock ticks */
               comp_t  ac_stime;       /* acctng system time in clock ticks */
               comp_t  ac_etime;       /* acctng elapsed time in clock ticks */
               comp_t  ac_mem;         /* memory usage in clicks */
               comp_t  ac_io;          /* chars trnsfrd by read/write */
               comp_t  ac_rw;          /* number of block reads/writes */
               char    ac_comm[8];     /* command name */
           };
           #define AFORK   01          /* has executed fork, but no exec */
           #define ASU     02          /* used super-user privileges */
           #define ACCTF   0300        /* record type: 00 = acct */

      In ac_flag, the AFORK flag is turned on by each fork() and turned off
      by an exec() (see fork(2) and exec(2)).  The ac_comm field is
      inherited from the parent process and is reset by any exec().  Each
      time the system charges the process with a clock tick, it also adds to
      ac_mem the current process size, computed as follows:

           (data size) + (text size) + (number of in-core processes sharing text) +
           sum of ((shared memory segment size) / (number of in-core processes attached to segment))

      For systems with virtual memory, the text, data, and shared memory
      sizes refer to the resident portion of the memory segments.  The value
      of ac_mem/(ac_stime+ac_utime) can be viewed as an approximation to the
      mean process size, as modified by text-sharing.

      The tacct structure, which resides with the source files of the
      accounting commands, represents the total accounting format used by
      the various accounting commands:

           /*
           * total accounting (for acct period), also for day



 Hewlett-Packard Company            - 1 -   HP-UX 11i Version 2: August 2003






 acct(4)                                                             acct(4)




           */
           struct tacct {
               uid_t           ta_uid;      /* userid */
               char            ta_name[8];  /* login name */
               float           ta_cpu[2];   /* cum. cpu time, p/np (mins) */
               float           ta_kcore[2]; /* cum kcore-minutes, p/np */
               float           ta_con[2];   /* cum. connect time, p/np, mins */
               float           ta_du;       /* cum. disk usage */
               long            ta_pc;       /* count of processes */
               unsigned short  ta_sc;       /* count of login sessions */
               unsigned short  ta_dc;       /* count of disk samples */
               short           ta_fee;      /* fee for special services */
           };

 WARNINGS    [Toc]    [Back]
      The ac_mem value for a short-lived command gives little information
      about the actual size of the command because ac_mem can be incremented
      while a different command (such as the shell) is being executed by the
      process.

      Kernel internal structures may change from release to release without
      warning.  Applications directly relying on these structures are not
      supported.

      Accounting files are currently written in 32-bit format.  Thus, 64-bit
      applications which read the files need to make special provisions.  In
      particular, the acct.h header declares the ac_btime field as int32_t
      rather than a time_t in 64-bit compilations.  The ac_btime field
      should be cast to time_t in the application before using it (e.g., in
      calls to date conversion functions).  The accounting file format will
      be changed to a 64-bit layout at a future release.

 SEE ALSO    [Toc]    [Back]
      acct(2), acct(1M), acctcom(1M), exec(2), fork(2).

 STANDARDS CONFORMANCE    [Toc]    [Back]
      acct: SVID2, SVID3, XPG2


 Hewlett-Packard Company            - 2 -   HP-UX 11i Version 2: August 2003