NAME

acct − per-process accounting file format

SYNOPSIS

#include <sys/acct.h>

DESCRIPTION

Files produced as a result of calling acct(2) contain records in the form defined by <sys/acct.h>:

typedef  ushort comp_t;/∗ "floating point" ∗/
/∗ 13-bit fraction, 3-bit exponent  ∗/
 structacct
{
charac_flag;/∗ Accounting flag ∗/
charac_stat;/∗ Exit status ∗/
ushortac_uid;/∗ Accounting user ID ∗/
ushortac_gid;/∗ Accounting group ID ∗/
dev_tac_tty;/∗ control typewriter ∗/
time_tac_btime;/∗ Beginning time ∗/
comp_tac_utime;/∗ acctng user time in clock ticks ∗/
comp_tac_stime;/∗ acctng system time in clock ticks ∗/
comp_tac_etime;/∗ acctng elapsed time in clock ticks ∗/
comp_tac_mem;/∗ memory usage in clicks ∗/
comp_tac_io;/∗ chars trnsfrd by read/write ∗/
comp_tac_rw;/∗ number of block reads/writes ∗/
charac_comm[8];/∗ command name ∗/
};
 externstructacctacctbuf;
externstructinode∗acctp;  /∗ inode of accounting file ∗/
 #defineAFORK01 /∗ has executed fork, but no exec ∗/
#defineASU02/∗ used super-user privileges ∗/
#defineACCTF0300/∗ record type: 00 = acct ∗/

In ac_flag, the AFORK flag is turned on by each fork(2) and turned off by an exec(2). The ac_comm field is inherited from the parent process and is reset by any exec. Each time the system charges the process with a clock tick, it also adds to ac_mem the current process size, computed as follows:

(data size) + (text size) / (number of in-core processes using text)

The value of ac_mem/(ac_stime+ac_utime) can be viewed as an approximation to the mean process size, as modified by text-sharing. 

The structure tacct.h, which resides with the source files of the accounting commands, represents the total accounting format used by the various accounting commands:

/∗
 ∗  total accounting (for acct period), also for day
 ∗/
 structtacct {
uid_tta_uid;/∗ userid ∗/
charta_name[8];/∗ login name ∗/
floatta_cpu[2];/∗ cum. cpu time, p/np (mins) ∗/
floatta_kcore[2];/∗ cum kcore-minutes, p/np ∗/
floatta_con[2];/∗ cum. connect time, p/np, mins ∗/
floatta_du;/∗ cum. disk usage ∗/
longta_pc;/∗ count of processes ∗/
unsigned shortta_sc;/∗ count of login sessions ∗/
unsigned shortta_dc;/∗ count of disk samples ∗/
unsigned shortta_fee;/∗ fee for special services ∗/
};

SEE ALSO

acct(1M), acct(2), acctcom(1), exec(2), fork(2)

BUGS

The ac_mem value for a short-lived command gives little information about the actual size of the command, because ac_mem may be incremented while a different command (e.g., the shell) is being executed by the process. 

September 02, 1992