ACCT(4)              INTERACTIVE UNIX System              ACCT(4)



          NAME
               acct - per-process accounting file format

          SYNOPSIS
               #include <sys/acct.h>

          DESCRIPTION
               Files produced as a result of calling acct(2) have records
               in the form defined by <sys/acct.h>, whose contents are:

               typedef   ushort comp_t;/* "floating point" */
                                   /* 13-bit fraction, 3-bit exponent  */

               struct    acct
               {
                    char ac_flag;  /* Accounting flag */
                    char ac_stat;  /* Exit status */
                    ushort    ac_uid;/* Accounting user ID */
                    ushort    ac_gid;/* Accounting group ID */
                    dev_t     ac_tty;/* control typewriter */
                    time_t    ac_btime;/* Beginning time */
                    comp_t    ac_utime;/* acctng user time in clock ticks */
                    comp_t    ac_stime;/* acctng system time in clock ticks */
                    comp_t    ac_etime;/* acctng elapsed time in clock ticks */
                    comp_t    ac_mem;/* memory usage in clicks */
                    comp_t    ac_io;/* chars trnsfrd by read/write */
                    comp_t    ac_rw;/* number of block reads/writes */
                    char ac_comm[8];/* command name */
               };

               extern    struct    acctacctbuf;
               extern    struct    inode*acctp;/* inode of accounting file */

               #define AFORK  01   /* has executed fork, but no exec */
               #define ASU    02   /* used super-user privileges */
               #define ACCTF  0300 /* record type: 00 = acct */

               In ac_flag, the AFORK flag is turned on by each fork(2)  and
               turned  off  by  an exec(2).  The ac_comm field is inherited
               from the parent process and is reset by any exec.  Each time
               the  system  charges  the process with a clock tick, it also
               adds to ac_mem the current process size,  computed  as  fol-
               lows:

               (data size) + (text size) /  (number  of  in-core  processes
               using text)

               The value of ac_mem/(ac_stime+ac_utime) can be viewed as  an
               approximation  to the mean process size, as modified by text
               sharing.





          Rev.                                                       Page 1

          ACCT(4)              INTERACTIVE UNIX System              ACCT(4)



               The structure tacct, which resides with the source files  of
               the  accounting  commands,  represents  the total accounting
               format used by the various accounting commands:

               /*
                *  total accounting (for acct period), also for day
                */

               struct       tacct {
                    uid_t   ta_uid;  /* userid */
                    char    ta_name[8];/* login name */
                    float   ta_cpu[2];/* cum. cpu time, p/np (mins) */
                    float   ta_kcore[2];/* cum kcore-minutes, p/np */
                    float   ta_con[2];/* cum. connect time, p/np, mins */
                    float   ta_du;   /* cum. disk usage */
                    long    ta_pc;   /* count of processes */
                    unsigned short   ta_sc;/* count of login sessions */
                    unsigned short   ta_dc;/* count of disk samples */
                    unsigned short   ta_fee;/* fee for special services */
               };

          SEE ALSO
               acct(2), exec(2), fork(2).
               acct(1M),  acctcom(1)  in  the   INTERACTIVE   UNIX   System
               User's/System Administrator's Reference Manual.

          BUGS
               The ac_mem value for  a  short-lived  command  gives  little
               information  about  the  actual size of the command, because
               ac_mem may be incremented while a different  command  (e.g.,
               the shell) is being executed by the process.
























          Rev.                                                       Page 2