acct(4)
NAME
acct − per-process accounting file format
SYNOPSIS
#include <sys/types.h>
#include <sys/acct.h>
DESCRIPTION
Files produced as a result of calling acct(2) have records in the form defined by <sys/acct.h>, whose contents are:
typedef ushort comp_t; /∗ "floating point" ∗/
/∗ 13-bit fraction, 3-bit exponent ∗/
| struct | acct | ||
| { | |||
| char | ac_flag; | /∗ Accounting flag ∗/ | |
| char | ac_stat; | /∗ Exit status ∗/ | |
| uid_t | ac_uid; | /∗ Accounting user ID ∗/ | |
| gid_t | ac_gid; | /∗ Accounting group ID ∗/ | |
| dev_t | ac_tty; | /∗ control typewriter ∗/ | |
| time_t | ac_btime; | /∗ Beginning time ∗/ | |
| comp_t | ac_utime; | /∗ accounting user time in clock ticks ∗/ | |
| comp_t | ac_stime; | /∗ accounting system time in clock ticks ∗/ | |
| comp_t | ac_etime; | /∗ accounting elapsed time in clock ticks ∗/ | |
| comp_t | ac_mem; | /∗ memory usage in clicks ∗/ | |
| comp_t | ac_io; | /∗ chars transferred by read/write ∗/ | |
| comp_t | ac_rw; | /∗ number of block reads/writes ∗/ | |
| char | ac_comm[8]; | /∗ command name ∗/ | |
| }; | |||
| extern | struct | acct | acctbuf; |
| extern | struct | vnode | ∗acctp; /∗ vnode of accounting file ∗/ |
| #define | AFORK | 01 | /∗ has executed fork, but no exec ∗/ |
| #define | ASU | 02 | /∗ used super-user privileges ∗/ |
| #define | ACCTF | 0300 | /∗ record type: 00 = acct ∗/ |
| #define | AEXPND | 040 | /∗ Expanded Record Type∗/ |
In ac_flag, the AFORK flag is turned on by each fork and turned off by an exec. The ac_comm field is inherited from the parent process and is reset by any exec. Each time the system charges the process with a clock tick, it also adds to ac_mem the current process size, computed as follows:
(data size) + (text size) / (number of in-core processes using text)
The value of ac_mem/(ac_stime+ac_utime) can be viewed as an approximation to the mean process size, as modified by text sharing.
The structure tacct, (which resides with the source files of the accounting commands), represents the total accounting format used by the various accounting commands:
/∗
∗ total accounting (for acct period), also for day
∗/
| struct | tacct { | ||
| uid_t | ta_uid; | /∗ userid ∗/ | |
| char | ta_name[8]; | /∗ login name ∗/ | |
| float | ta_cpu[2]; | /∗ cum. cpu time, p/np (mins) ∗/ | |
| float | ta_kcore[2]; | /∗ cum kcore-minutes, p/np ∗/ | |
| float | ta_con[2]; | /∗ cum. connect time, p/np, mins ∗/ | |
| float | ta_du; | /∗ cum. disk usage ∗/ | |
| long | ta_pc; | /∗ count of processes ∗/ | |
| unsigned short | ta_sc; | /∗ count of login sessions ∗/ | |
| unsigned short | ta_dc; | /∗ count of disk samples ∗/ | |
| unsigned short | ta_fee; | /∗ fee for special services ∗/ | |
| }; |
SEE ALSO
acctcom(1), acct(1M), acct(2), exec(2), fork(2)
NOTES
The ac_mem value for a short-lived command gives little information about the actual size of the command, because ac_mem may be incremented while a different command (for example, the shell) is being executed by the process.
SunOS 5.1/SPARC — Last change: 3 Jul 1990