ACCT(4) — Silicon Graphics
NAME
acct − per-process accounting file format
SYNOPSIS
#include <sys/acct.h>
DESCRIPTION
Files produced as a result of calling acct(2) have records in the form defined by <sys/acct.h>, whose contents are:
| typedef | ushort comp_t; | /∗ "floating point" ∗/ |
| /∗ 13-bit fraction, 3-bit exponent ∗/ |
| struct | acct { | ||
| char | ac_flag; | /∗ Accounting flag ∗/ | |
| char | ac_stat; | /∗ Exit status ∗/ | |
| ushort | ac_uid; | /∗ Accounting user ID ∗/ | |
| ushort | ac_gid; | /∗ Accounting group ID ∗/ | |
| dev_t | ac_tty; | /∗ control typewriter ∗/ | |
| time_t | ac_btime; | /∗ Beginning time ∗/ | |
| comp_t | ac_utime; | /∗ acctng user time in clock ticks ∗/ | |
| comp_t | ac_stime; | /∗ acctng system time in clock ticks ∗/ | |
| comp_t | ac_etime; | /∗ acctng elapsed time in clock ticks ∗/ | |
| comp_t | ac_mem; | /∗ memory usage in clicks ∗/ | |
| comp_t | ac_io; | /∗ chars trnsfrd by read/write ∗/ | |
| comp_t | ac_rw; | /∗ number of block reads/writes ∗/ | |
| char | ac_comm[8]; | /∗ command name ∗/ | |
| }; | |||
| extern | struct | acct acctbuf; | |
| extern | struct | inode ∗acctp; | /∗ inode of accounting file ∗/ |
| #define | AFORK | 01 | /∗ has executed fork, but no exec ∗/ |
| #define | ASU | 02 | /∗ used super-user privileges ∗/ |
| #define | ACCTF | 0300 | /∗ record type: 00 = acct ∗/ |
In ac_flag, the AFORK flag is turned on by each fork(2) and turned off by an exec(2). The ac_comm field is inherited from the parent process and is reset by any exec. Each time the system charges the process with a clock tick, it also adds to ac_mem the current process size, computed as follows:
(data size) + (text size) / (number of in-core processes using text)
The value of ac_mem/(ac_stime+ac_utime) can be viewed as an approximation to the mean process size, as modified by text-sharing.
The structure tacct, which resides with the source files of the accounting commands, represents the total accounting format used by the various accounting commands:
| / | ∗ | |
| ∗ | total accounting (for acct period), also for day | |
| ∗/ |
| struct | tacct { | ||
| uid_t | ta_uid; | /∗ userid ∗/ | |
| char | ta_name[8]; | /∗ login name ∗/ | |
| float | ta_cpu[2]; | /∗ cum. cpu time, p/np (mins) ∗/ | |
| float | ta_kcore[2]; | /∗ cum kcore-minutes, p/np ∗/ | |
| float | ta_con[2]; | /∗ cum. connect time, p/np, mins ∗/ | |
| float | ta_du; | /∗ cum. disk usage ∗/ | |
| long | ta_pc; | /∗ count of processes ∗/ | |
| unsigned short | ta_sc; | /∗ count of login sessions ∗/ | |
| unsigned short | ta_dc; | /∗ count of disk samples ∗/ | |
| unsigned short | ta_fee; | /∗ fee for special services ∗/ | |
| }; |
SEE ALSO
acct(1M), acctcom(1), acct(2).
BUGS
The ac_mem value for a short-lived command gives little information about the actual size of the command, because ac_mem may be incremented while a different command (e.g., the shell) is being executed by the process.
Version 2.3 — July 04, 1985