acct(4)

NAME

acct − per-process accounting file format

SYNOPSIS

#include <sys/types.h>
#include <sys/acct.h>

DESCRIPTION

Files produced as a result of calling acct(2) have records in the form defined by <sys/acct.h>, whose contents are:

typedef ushort comp_t;/∗ pseudo "floating point" representation ∗/
/∗ 3 bit base-8 exponent in the high ∗/
/∗ order bits, and a 13-bit fraction ∗/
/∗ in the low order bits. ∗/
structacct
{
charac_flag;/∗ Accounting flag ∗/
charac_stat;/∗ Exit status ∗/
uid_tac_uid;/∗ Accounting user ID ∗/
gid_tac_gid;/∗ Accounting group ID ∗/
dev_tac_tty;/∗ control tty ∗/
time_tac_btime;/∗ Beginning time ∗/
comp_tac_utime;/∗ accounting user time in clock ∗/
/∗ ticks ∗/
comp_tac_stime;/∗ accounting system time in clock ∗/
/∗ ticks ∗/
comp_tac_etime;/∗ accounting total elapsed time in clock ∗/
/∗ ticks ∗/
comp_tac_mem;/∗ memory usage in clicks (pages) ∗/
comp_tac_io;/∗ chars transferred by read/write ∗/
comp_tac_rw;/∗ number of block reads/writes ∗/
charac_comm[8];/∗ command name ∗/
};
/∗
∗ Accounting Flags
∗/
#defineAFORK01/∗ has executed fork, but no exec ∗/
#defineASU02/∗ used super-user privileges ∗/
#defineACCTF0300/∗ record type ∗/
#defineAEXPND040 /∗ Expanded Record Type − default ∗/

In ac_flag, the AFORK flag is turned on by each fork and turned off by an exec. The ac_comm field is inherited from the parent process and is reset by any exec. Each time the system charges the process with a clock tick, it also adds to ac_mem the current process size, computed as follows:

(data size) + (text size) / (number of in-core processes using text)

The value of ac_mem/(ac_stime+ac_utime) can be viewed as an approximation to the mean process size, as modified by text sharing.

The structure tacct, (which resides with the source files of the accounting commands), represents a summary of accounting statistics for the user id ta_uid. This structure is used by the accounting commands to report statistics based on user id.

/∗
∗ total accounting (for acct period), also for day
∗/

structtacct {
uid_tta_uid;/∗ user id ∗/
charta_name[8];/∗ login name ∗/
floatta_cpu[2];/∗ cum. cpu time in minutes, ∗/
/∗ p/np (prime/non-prime time) ∗/
floatta_kcore[2];/∗ cum. kcore-minutes, p/np ∗/
floatta_con[2];/∗ cum. connect time in minutes, ∗/
/∗ p/np ∗/
floatta_du;/∗ cum. disk usage (blocks)∗/
longta_pc;/∗ count of processes ∗/
unsigned shortta_sc;/∗ count of login sessions ∗/
unsigned shortta_dc;/∗ count of disk samples ∗/
unsigned shortta_fee;/∗ fee for special services ∗/
};

ta_cpu, ta_kcore, and ta_con contain usage information pertaining to prime time and non-prime time hours. The first element in each array represents the time the resource was used during prime time hours. The second element in each array represents the time the resource was used during non-prime time hours. Prime time and non-prime time hours may be set in the holidays file (see holidays(4)).

ta_kcore is a cumulative measure of the amount of memory used over the accounting period by processes owned by the user with uid ta_uid. The amount shown represents kilobyte segments of memory used, per minute.

ta_con represents the amount of time the user was logged in to the system.

FILES

/etc/acct/holidays prime/non-prime time table

NOTES

The ac_mem value for a short-lived command gives little information about the actual size of the command, because ac_mem may be incremented while a different command (for example, the shell) is being executed by the process.

SunOS 5.6 — Last change: 19 May 1994

Museum