acct.4 (2010 09)

a
acct(4) acct(4)
NAME
acct - per-process accounting file format
SYNOPSIS
#include <sys/acct.h>
DESCRIPTION
Files produced as a result of calling
acct() (see acct (2)) have records in the form defined by
<sys/acct.h>, whose contents are:
typedef ushort comp_t; /* "floating point":
13-bit fraction, 3-bit exponent */
struct acct {
char ac_flag; /* Accounting flag */
char ac_stat; /* Exit status */
uid_t ac_uid; /* Accounting user ID */
gid_t ac_gid; /* Accounting group ID */
dev_t ac_tty; /* control typewriter */
time_t ac_btime; /* Beginning time */
comp_t ac_utime; /* acctng user time in clock ticks */
comp_t ac_stime; /* acctng system time in clock ticks */
comp_t ac_etime; /* acctng elapsed time in clock ticks */
comp_t ac_mem; /* memory usage in clicks */
comp_t ac_io; /* chars trnsfrd by read/write */
comp_t ac_rw; /* number of block reads/writes */
char ac_comm[8]; /* command name */
};
#define AFORK 01 /* has executed fork, but no exec */
#define ASU 02 /* used super-user privileges */
#define ACCTF 0300 /* record type: 00 = acct */
In ac_flag, the AFORK flag is turned on by each fork() and turned off by an
exec() (see fork(2)
and exec(2)). The
ac_comm field is inherited from the parent process and is reset by any
exec().
Each time the system charges the process with a clock tick, it also adds to
ac_mem the current process
size, computed as follows:
(data size) + (text size) + (number of in-core processes sharing text) +
sum of ((shared memory segment size) / (number of in-core processes attached to segment))
For systems with virtual memory, the text, data, and shared memory sizes refer to the resident portion of
the memory segments. The value of
ac_mem /(ac_stime+ac_utime) can be viewed as an approxima-
tion to the mean process size, as modified by text-sharing.
The
tacct structure, which resides with the source files of the accounting commands, represents the
total accounting format used by the various accounting commands:
/*
* total accounting (for acct period), also for day
*/
struct tacct {
uid_t ta_uid; /* userid */
char ta_name[8]; /* login name */
float ta_cpu[2]; /* cum. cpu time, p/np (mins) */
float ta_kcore[2]; /* cum kcore-minutes, p/np */
float ta_con[2]; /* cum. connect time, p/np, mins */
float ta_du; /* cum. disk usage */
long ta_pc; /* count of processes */
unsigned short ta_sc; /* count of login sessions */
unsigned short ta_dc; /* count of disk samples */
short ta_fee; /* fee for special services */
};
WARNINGS
The ac_mem value for a short-lived command gives little information about the actual size of the com-
mand because ac_mem can be incremented while a different command (such as the shell) is being
HP-UX 11i Version 3: September 2010 − 1 − Hewlett-Packard Company 1