acct(4)                                                             acct(4)


   NAME
         acct - per-process accounting file format

   SYNOPSIS
         #include <sys/types.h>
         #include <sys/acct.h>

   DESCRIPTION
         Files produced as a result of calling acct(2) have records in the
         form defined by <sys/acct.h>, whose contents are:

         typedef  ushort comp_t; /* "floating point" */
                     /* 13-bit fraction, 3-bit exponent  */

         struct  acct
         {
                 char   ac_flag;    /* Accounting flag */
                 char   ac_stat;    /* Exit status */
                 uid_t  ac_uid;     /* Accounting user ID */
                 gid_t  ac_gid;     /* Accounting group ID */
                 dev_t  ac_tty;     /* control typewriter */
                 time_t ac_btime;   /* Beginning time */
                 comp_t ac_utime;   /* acctng user time in clock ticks */
                 comp_t ac_stime;   /* acctng system time in clock ticks */
                 comp_t ac_etime;   /* acctng elapsed time in clock ticks */
                 comp_t ac_mem;     /* memory usage in clicks */
                 comp_t ac_io;      /* chars trnsfrd by read/write */
                 comp_t ac_rw;      /* number of block reads/writes */
                 char   ac_comm[8]; /* command name */
         };

         extern  struct acct        acctbuf;
         extern  struct vnode       *acctp;  /* vnode of accounting file */

         #define AFORK  01          /* has executed fork, but no exec */
         #define ASU    02          /* used super-user privileges */
         #define ACCTF  0300        /* record type: 00 = acct */
         #define AEXPND 040         /*Expanded Record Type*/

         In ac_flag, the AFORK flag is turned on by each fork and turned off
         by an exec.  The ac_comm field is inherited from the parent process
         and is reset by any exec.  Each time the system charges the process
         with a clock tick, it also adds to ac_mem the current process size,
         computed as follows:

               (data size) + (text size) / (number of in-core processes using
               text)

         The value of ac_mem/(ac_stime+ac_utime) can be viewed as an
         approximation to the mean process size, as modified by text sharing.



   7/91                                                                 Page 1

   acct(4)                                                             acct(4)


         The structure tacct, which resides with the source files of the
         accounting commands, represents the total accounting format used by
         the various accounting commands:

         /*
          *  total accounting (for acct period), also for day
          */

         struct tacct {
                uid_t          ta_uid;      /* userid */
                char           ta_name[8];  /* login name */
                float          ta_cpu[2];   /* cum. cpu time, p/np (mins) */
                float          ta_kcore[2]; /* cum kcore-minutes, p/np */
                float          ta_con[2];   /* cum. connect time, p/np, mins */
                float          ta_du;       /* cum. disk usage */
                long           ta_pc;       /* count of processes */
                unsigned short ta_sc;       /* count of login sessions */
                unsigned short ta_dc;       /* count of disk samples */
                unsigned short ta_fee;      /* fee for special services */
         };

   SEE ALSO
         acct(2), exec(2), fork(2).
         acct(1M) in the System Administrator's Reference Manual.
         acctcom(1) in the User's Reference Manual.

   NOTES
         The ac_mem value for a short-lived command gives little information
         about the actual size of the command, because ac_mem may be
         incremented while a different command (e.g., the shell) is being
         executed by the process.






















   Page 2                                                                 7/91