NAME
acct — per-process accounting file format
DESCRIPTION
Files produced as a result of calling
acct()
(see
acct(2))
have records in the form defined by
<sys/acct.h>,
whose contents are:
typedef ushort comp_t; /* "floating point":
13-bit fraction, 3-bit exponent */
struct acct {
char ac_flag; /* Accounting flag */
char ac_stat; /* Exit status */
uid_t ac_uid; /* Accounting user ID */
gid_t ac_gid; /* Accounting group ID */
dev_t ac_tty; /* control typewriter */
time_t ac_btime; /* Beginning time */
comp_t ac_utime; /* acctng user time in clock ticks */
comp_t ac_stime; /* acctng system time in clock ticks */
comp_t ac_etime; /* acctng elapsed time in clock ticks */
comp_t ac_mem; /* memory usage in clicks */
comp_t ac_io; /* chars trnsfrd by read/write */
comp_t ac_rw; /* number of block reads/writes */
char ac_comm[8]; /* command name */
};
#define AFORK 01 /* has executed fork, but no exec */
#define ASU 02 /* used super-user privileges */
#define ACCTF 0300 /* record type: 00 = acct */
In
ac_flag,
the
AFORK
flag is turned on by each
fork()
and turned off by an
exec()
(see
fork(2)
and
exec(2)).
The
ac_comm
field is inherited from the parent process and is reset by any
exec().
Each time the system charges the process with a clock tick,
it also adds to
ac_mem
the current process size, computed as follows:
(data size) + (text size) + (number of in-core processes sharing text) +
sum of ((shared memory segment size) / (number of in-core processes attached to segment))
For systems with virtual memory, the text, data, and shared memory
sizes refer to the resident portion of the memory segments.
The value of
ac_mem/(ac_stime+ac_utime)
can be viewed as an approximation to the mean process size,
as modified by text-sharing.
The
tacct
structure,
which resides with the source files of the accounting commands,
represents the total accounting format
used by the various accounting commands:
/*
* total accounting (for acct period), also for day
*/
struct tacct {
uid_t ta_uid; /* userid */
char ta_name[8]; /* login name */
float ta_cpu[2]; /* cum. cpu time, p/np (mins) */
float ta_kcore[2]; /* cum kcore-minutes, p/np */
float ta_con[2]; /* cum. connect time, p/np, mins */
float ta_du; /* cum. disk usage */
long ta_pc; /* count of processes */
unsigned short ta_sc; /* count of login sessions */
unsigned short ta_dc; /* count of disk samples */
short ta_fee; /* fee for special services */
};
WARNINGS
The
ac_mem
value for a short-lived command
gives little information about the actual size of the command because
ac_mem
can be incremented while a different command
(such as the shell) is being executed by the process.
Kernel internal structures may change from release to release
without warning.
Applications directly relying on these structures are not supported.
Accounting files are currently written in 32-bit format. Thus,
64-bit applications which read the files need to make special
provisions.
In particular, the
acct.h
header declares
the
ac_btime
field as
int32_t
rather than a
time_t
in 64-bit compilations.
The
ac_btime
field should be cast to
time_t
in the application
before using it (e.g., in calls to date conversion functions).
The accounting file format will be changed to a 64-bit layout at
a future release.
STANDARDS CONFORMANCE
acct: SVID2, SVID3, XPG2
Printable version
