ACCT(4) — HP-UX
NAME
acct − per-process accounting file format
SYNOPSIS
#include <sys/acct.h>
DESCRIPTION
Files produced as a result of calling acct(2) have records in the form defined by <sys/acct.h>, whose contents are:
typedefushort comp_t;/∗ "floating point": 13-bit fraction, 3-bit exponent ∗/
structacct {
| char | ac_flag; | /∗ Accounting flag ∗/ | |
| char | ac_stat; | /∗ Exit status ∗/ | |
| ushort | ac_uid; | /∗ Accounting user ID ∗/ | |
| ushort | ac_gid; | /∗ Accounting group ID ∗/ | |
| dev_t | ac_tty; | /∗ control typewriter ∗/ | |
| time_t | ac_btime; | /∗ Beginning time ∗/ | |
| comp_t | ac_utime; | /∗ acctng user time in clock ticks ∗/ | |
| comp_t | ac_stime; | /∗ acctng system time in clock ticks ∗/ | |
| comp_t | ac_etime; | /∗ acctng elapsed time in clock ticks ∗/ | |
| comp_t | ac_mem; | /∗ memory usage in clicks ∗/ | |
| comp_t | ac_io; | /∗ chars trnsfrd by read/write ∗/ | |
| comp_t | ac_rw; | /∗ number of block reads/writes ∗/ | |
| char | ac_comm[8]; | /∗ command name ∗/ | |
| }; |
| #define AFORK | 01 | /∗ has executed fork, but no exec ∗/ |
| #define ASU | 02 | /∗ used super-user privileges ∗/ |
| #define ACCTF | 0300 | /∗ record type: 00 = acct ∗/ |
In ac_flag, the AFORK flag is turned on by each fork(2) and turned off by an exec(2). The ac_comm field is inherited from the parent process and is reset by any exec. Each time the system charges the process with a clock tick, it also adds to ac_mem the current process size, computed as follows:
(data size) + (text size) + (number of in-core processes sharing text) +
sum of ((shared memory segment size) / (number of in-core processes attached to segment))
For systems with virtual memory, the text, data, and shared memory sizes refer to the resident portion of the memory segments. The value of ac_mem/(ac_stime+ac_utime) can be viewed as an approximation to the mean process size, as modified by text-sharing.
The structure tacct.h, which resides with the source files of the accounting commands, represents the total accounting format used by the various accounting commands:
/∗
∗ total accounting (for acct period), also for day
∗/
structtacct {
| uid_t | ta_uid; | /∗ userid ∗/ | |
| char | ta_name[8]; | /∗ login name ∗/ | |
| float | ta_cpu[2]; | /∗ cum. cpu time, p/np (mins) ∗/ | |
| float | ta_kcore[2]; | /∗ cum kcore-minutes, p/np ∗/ | |
| float | ta_con[2]; | /∗ cum. connect time, p/np, mins ∗/ | |
| float | ta_du; | /∗ cum. disk usage ∗/ | |
| long | ta_pc; | /∗ count of processes ∗/ | |
| unsigned short | ta_sc; | /∗ count of login sessions ∗/ | |
| unsigned short | ta_dc; | /∗ count of disk samples ∗/ | |
| short | ta_fee; | /∗ fee for special services ∗/ |
};
SEE ALSO
acct(2), acct(1M), acctcom(1M), exec(2), fork(2).
BUGS
The ac_mem value for a short-lived command gives little information about the actual size of the command, because ac_mem may be incremented while a different command (e.g., the shell) is being executed by the process.
Hewlett-Packard Company — May 11, 2021