NAME

acct − per-process accounting file format

SYNOPSIS

#include <sys/acct.h>

DESCRIPTION

Files produced as a result of calling acct(2) have records in the form defined by <sys/acct.h>, whose contents are:

/*
 * Accounting structures
 */
 typedefushort comp_t;/* "floating point" */
/* 13-bit fraction, 3-bit exponent  */
 structacct
{
charac_flag;/* Accounting flag */
charac_stat;/* Exit status */
ushortac_uid;/* Accounting user ID */
ushortac_gid;/* Accounting group ID */
dev_tac_tty;/* control typewriter */
time_tac_btime;/* Beginning time */
comp_tac_utime;/* acctng user time in clock ticks */
comp_tac_stime;/* acctng system time in clock ticks */
comp_tac_etime;/* acctng elapsed time in clock ticks */
comp_tac_mem;/* memory usage */
comp_tac_io;/* chars transferred */
comp_tac_rw;/* blocks read or written */
charac_comm[8];/* command name */
};
 externstructacctacctbuf;
externstructinode*acctp;/* inode of accounting file */
 #defineAFORK01/* has executed fork, but no exec */
#defineASU02/* used super-user privileges */
#defineACCTF0300/* record type: 00 = acct */

In ac_flag, the AFORK flag is turned on by each fork(2) and turned off by an exec(2). The ac_comm field is inherited from the parent process and is reset by any exec. Each time the system charges the process with a clock tick, it also adds to ac_mem the current process size, computed as follows:

(data size) + (text size) / (number of in-core processes using text)

The value of ac_mem/ac_stime can be viewed as an approximation to the mean process size, as modified by text-sharing. 

The following structure represents the total accounting format used by the various accounting commands:

/*
 *total accounting (for acct period), also for day
 */
 structtacct{
uid_tta_uid;/* userid */
charta_name[8];/* login name */
floatta_cpu[2];/* cum. cpu time, p/np (mins) */
floatta_kcore[2];/* cum kcore-minutes, p/np */
floatta_con[2];/* cum. connect time, p/np, mins */
floatta_du;/* cum. disk usage */
longta_pc;/* count of processes */
unsigned shortta_sc;/* count of login sessions */
unsigned shortta_dc;/* count of disk samples */
unsigned shortta_fee;/* fee for special services */
};

SEE ALSO

acct(1M), acctcom(1), acct(2). 

BUGS

The ac_mem value for a short-lived command gives little information about the actual size of the command, because ac_mem may be incremented while a different command (e.g., the shell) is being executed by the process. 

May 16, 1980