acct(4)

NAME

acct − per-process accounting file format

SYNOPSIS

#include <sys/acct.h>

DESCRIPTION

Files produced as a result of calling acct() (see acct(2)) have records in the form defined by <sys/acct.h>, whose contents are:

typedef ushort comp_t; /* "floating point":
                               13-bit fraction, 3-bit exponent */
struct acct {
    char    ac_flag;        /* Accounting flag */
    char    ac_stat;        /* Exit status */
    ushort ac_uid;         /* Accounting user ID */
    ushort ac_gid;         /* Accounting group ID */
    dev_t   ac_tty;         /* control typewriter */
    time_t ac_btime;       /* Beginning time */
    comp_t ac_utime;       /* acctng user time in clock ticks */
    comp_t ac_stime;       /* acctng system time in clock ticks */
    comp_t ac_etime;       /* acctng elapsed time in clock ticks */
    comp_t ac_mem;         /* memory usage in clicks */
    comp_t ac_io;          /* chars trnsfrd by read/write */
    comp_t ac_rw;          /* number of block reads/writes */
    char    ac_comm[8];     /* command name */
};
#define AFORK   01          /* has executed fork, but no exec */
#define ASU     02          /* used super-user privileges */
#define ACCTF   0300        /* record type: 00 = acct */

In ac_flag, the AFORK flag is turned on by each fork() and turned off by an exec() (see fork(2) and exec(2)). The ac_comm field is inherited from the parent process and is reset by any exec(). Each time the system charges the process with a clock tick, it also adds to ac_mem the current process size, computed as follows:

(data size) + (text size) + (number of in-core processes sharing text) +
sum of ((shared memory segment size) / (number of in-core processes attached to segment))

For systems with virtual memory, the text, data, and shared memory sizes refer to the resident portion of the memory segments. The value of ac_mem/(ac_stime+ac_utime) can be viewed as an approximation to the mean process size, as modified by text-sharing.

The tacct structure, which resides with the source files of the accounting commands, represents the total accounting format used by the various accounting commands:

/*
* total accounting (for acct period), also for day
*/
struct tacct {
    uid_t           ta_uid;      /* userid */
    char            ta_name[8]; /* login name */
    float           ta_cpu[2];   /* cum. cpu time, p/np (mins) */
    float           ta_kcore[2]; /* cum kcore-minutes, p/np */
    float           ta_con[2];   /* cum. connect time, p/np, mins */
    float           ta_du;       /* cum. disk usage */
    long            ta_pc;       /* count of processes */
    unsigned short ta_sc;       /* count of login sessions */
    unsigned short ta_dc;       /* count of disk samples */
    short           ta_fee;      /* fee for special services */
};

WARNINGS

The ac_mem value for a short-lived command gives little information about the actual size of the command because ac_mem can be incremented while a different command (such as the shell) is being executed by the process.

STANDARDS CONFORMANCE

acct: SVID2, XPG2

Hewlett-Packard Company — HP-UX Release 9.0: August 1992

Museum