acct(4)								       acct(4)

NAME    [Toc]    [Back]

     acct - per-process	accounting file	format

SYNOPSIS    [Toc]    [Back]

     #include <sys/types.h>
     #include <sys/acct.h>

DESCRIPTION    [Toc]    [Back]

     Files produced as a result	of calling acct(2) have	records	in the form
     defined by	sys/acct.h, whose contents are:

	typedef	 ushort_t comp_t; /* "floating point" */
				/* 13-bit fraction, 3-bit exponent */
	struct	  acct
	{
	   char	  ac_flag;     /* Accounting flag */
	   char	  ac_stat;     /* Exit status */
	   uid_t  ac_uid;      /* Accounting user ID */
	   gid_t  ac_gid;      /* Accounting group ID */
	   dev_t  ac_tty;      /* control typewriter */
	   time_t ac_btime;    /* Beginning time */
	   comp_t ac_utime;    /* acctng user time in clock ticks */
	   comp_t ac_stime;    /* acctng system	time in	clock ticks */
	   comp_t ac_etime;    /* acctng elapsed time in clock ticks */
	   comp_t ac_mem;      /* memory usage in clicks */
	   comp_t ac_io;       /* chars	trnsfrd	by read/write */
	   comp_t ac_rw;       /* number of block reads/writes */
	   char	  ac_comm[8];  /* command name */
	};

	#define	AFORK	01     /* has executed fork, but no exec */
	#define	  ASU	  02	 /* used super-user privileges */
	#define	  ACCTF	  0300	 /* record type: 00 = acct */
	#define	  AEXPND  040	 /* Expanded Record Type*/

     In	ac_flag, the AFORK flag	is turned on by	each fork and turned off by an
     exec.  The	ac_comm	field is inherited from	the parent process and is
     reset by any exec.	 Each time the system charges the process with a clock
     tick, it also adds	to ac_mem the current resident process size (see ps(1)
     for a description of resident size).  This	consists of all	valid pages
     for a process, regardless of sharing.

     The value of ac_mem/(ac_stime+ac_utime) can be viewed as an approximation
     to	the mean process size.

     The structure tacct, which	resides	with the source	files of the
     accounting	commands, represents the total accounting format used by the
     various accounting	commands:

	/*
	 *  total accounting (for acct period),	also for day
	 */



									Page 1






acct(4)								       acct(4)



	struct	tacct {
	   uid_t	  ta_uid;	/* userid */
	   char		  ta_name[8];	/* login name */
	   float	  ta_cpu[2];	/* cum.	cpu time, p/np (mins) */
	   float	  ta_kcore[2];	/* cum kcore-minutes, p/np */
	   float	  ta_con[2];	/* cum.	connect	time, p/np, mins */
	   float	  ta_du;	/* cum.	disk usage */
	   long		  ta_pc;	/* count of processes */
	   unsigned short ta_sc;	/* count of login sessions */
	   unsigned short ta_dc;	/* count of disk samples */
	   unsigned short ta_fee;	/* fee for special services */
	};

REFERENCES    [Toc]    [Back]

     acct(1M), acct(2),	acctcom(1), exec(2), fork(2)

NOTICES    [Toc]    [Back]

     The ac_mem	value for a short-lived	command	gives little information about
     the actual	size of	the command, because ac_mem may	be incremented while a
     different command (for example, the shell)	is being executed by the
     process.


									PPPPaaaaggggeeee 2222