NAME

acct − per-process accounting file format

SYNOPSIS

#include <sys/acct.h>

DESCRIPTION

Files produced as a result of calling acct(2) have records in the form defined by <sys/acct.h>, whose contents are:

typedef ushort comp_t;/∗ "floating point" ∗/
/∗ 13-bit fraction, 3-bit exponent  ∗/

structacct
{
charac_flag;/∗ Accounting flag ∗/
charac_stat;/∗ Exit status ∗/
ushortac_uid;/∗ Accounting user ID ∗/
ushortac_gid;/∗ Accounting group ID ∗/
dev_tac_tty;/∗ control typewriter ∗/
time_tac_btime;/∗ Beginning time ∗/
comp_tac_utime;/∗ acctng user time in clock ticks ∗/
comp_tac_stime;/∗ acctng system time in clock ticks ∗/
comp_tac_etime;/∗ acctng elapsed time in clock ticks ∗/
comp_tac_mem;/∗ memory usage in clicks ∗/
comp_tac_io;/∗ chars trnsfrd by read/write ∗/
comp_tac_rw;/∗ number of block reads/writes ∗/
charac_comm[8];/∗ command name ∗/
};
 #defineAFORK01 /∗ has executed fork, but no exec ∗/
#defineASU02 /∗ used super-user privileges ∗/
#defineACCTF0300 /∗ record type: 00 = acct ∗/

In ac_flag, the AFORK flag is turned on by each fork(2) and turned off by an exec(2). The ac_comm field is inherited from the parent process and is reset by any exec. Each time the system charges the process with a clock tick, it also adds to ac_mem the current process size, computed as follows:

(data size) + (text size) / (number of in-core processes using text)

The value of ac_mem/(ac_stime+ac_utime) can be viewed as an approximation to the mean process size, as modified by text-sharing. 

The structure tacct.h, which resides with the source files of the accounting commands, represents the total accounting format used by the various accounting commands:

/∗
 ∗  total accounting (for acct period), also for day
 ∗/
 structtacct {
uid_tta_uid;/∗ userid ∗/
charta_name[8];/∗ login name ∗/
floatta_cpu[2];/∗ cum. cpu time, p/np (mins) ∗/
floatta_kcore[2];/∗ cum kcore-minutes, p/np ∗/
floatta_con[2];/∗ cum. connect time, p/np, mins ∗/
floatta_du;/∗ cum. disk usage ∗/
longta_pc;/∗ count of processes ∗/
unsigned shortta_sc;/∗ count of login sessions ∗/
unsigned shortta_dc;/∗ count of disk samples ∗/
shortta_fee;/∗ fee for special services ∗/
};

HARDWARE DEPENDENCIES

Series 500:

ac_mem includes only certain resident segments still held by a process when it terminates.  Because ac_mem does not account for shared or virtual memory, or for changes in the amount of memory allocated dynamically, ac_mem / (ac_stime + ac_utime) may not always furnish a good approximation of memory usage. 

SEE ALSO

acct(2), exec(2), fork(2). 
acct(1M), and acctcom(1) in the HP-UX Reference. 

BUGS

The ac_mem value for a short-lived command gives little information about the actual size of the command, because ac_mem may be incremented while a different command (e.g., the shell) is being executed by the process. 

Hewlett-Packard  —  last mod. May 11, 2021