'\"!  tbl | mmdoc
'\"macro stdmacro
.if n .pH g4.acct @(#)acct	40.9 of 10/10/89
.\" Copyright 1989 AT&T
.nr X
.if \nX=0 .ds x} acct 4 "" "\&"
.if \nX=1 .ds x} acct 4 ""
.if \nX=2 .ds x} acct 4 "" "\&"
.if \nX=3 .ds x} acct "" "" "\&"
.TH \*(x}
.SH NAME
\f4acct\f1 \- per-process accounting file format
.SH SYNOPSIS
\f4#include <sys/types.h>\f1
.br
\f4#include <sys/acct.h>\f1
.SH DESCRIPTION
Files produced as a result of calling
\f4acct\fP(2)
have records in the form defined by
\f4<sys/acct.h>\fP,
whose contents are:
.PP
.ft 4
.nf
typedef  ushort comp_t;	/\(** "floating point" \(**/
		/\(** 13-bit fraction, 3-bit exponent  \(**/
.fi
.ft 1
.P
.TS
lf4 1 lf4 1 lf4 1 lf4.
struct	acct
{
	char	ac_flag;	/\(** Accounting flag \(**/
	char	ac_stat;	/\(** Exit status \(**/
	uid_t	ac_uid;	/\(** Accounting user ID \(**/
	gid_t	ac_gid;	/\(** Accounting group ID \(**/
	dev_t	ac_tty;	/\(** control typewriter \(**/
	time_t	ac_btime;	/\(** Beginning time \(**/
	comp_t	ac_utime;	/\(** acctng user time in clock ticks \(**/
	comp_t	ac_stime;	/\(** acctng system time in clock ticks \(**/
	comp_t	ac_etime;	/\(** acctng elapsed time in clock ticks \(**/
	comp_t	ac_mem;	/\(** memory usage in clicks \(**/
	comp_t	ac_io;	/\(** chars trnsfrd by read/write \(**/
	comp_t	ac_rw;	/\(** number of block reads/writes \(**/
	char	ac_comm[8];	/\(** command name \(**/
};	

extern	struct	acct	acctbuf;
extern	struct	vnode	\(**acctp;  /\(** vnode of accounting file \(**/

#define	AFORK	01	/\(** has executed fork, but no exec \(**/
#define	ASU	02	/\(** used super-user privileges \(**/
#define	ACCTF	0300	/\(** record type: 00 = acct \(**/
#define	AEXPND	040	/\(**Expanded Record Type\(**/
.TE
.fi
.PP
In
\f4ac_flag\fP,
the
\f4AFORK\fP
flag is turned on by each
\f4fork\fP
and turned off by an
\f4exec\fP.
The
\f4ac_comm\fP
field is inherited from the parent process and
is reset by any
\f4exec\fP.
Each time the system charges the process with a clock tick,
it also adds to
\f4ac_mem\fP
the current process size, computed as follows:
.IP
\f2(data size) + (text size) / (number of in-core processes using text)\f1
.PP
The value of
\f4ac_mem\|/\|(ac_stime\|+\|ac_utime)\fP
can be viewed as an approximation to the
mean process size, as modified by text sharing.
.PP
.ne 20
The structure
\f4tacct\f1,
which resides with the source files of the accounting commands,
represents the total accounting format
used by the various accounting commands:
.PP
.nf
.ft 4
/\(**
 \(**  total accounting (for acct period), also for day
 \(**/
.ft 1
.fi
.PP
.TS
lf4 1 lf4 1 lf4 1 lf4.
struct	tacct {
	uid_t	ta_uid;	/\(** userid \(**/
	char	ta_name[8];	/\(** login name \(**/
	float	ta_cpu[2];	/\(** cum. cpu time, p/np (mins) \(**/
	float	ta_kcore[2];	/\(** cum kcore-minutes, p/np \(**/
	float	ta_con[2];	/\(** cum. connect time, p/np, mins \(**/
	float	ta_du;	/\(** cum. disk usage \(**/
	long	ta_pc;	/\(** count of processes \(**/
	unsigned short	ta_sc;	/\(** count of login sessions \(**/
	unsigned short	ta_dc;	/\(** count of disk samples \(**/
	unsigned short	ta_fee;	/\(** fee for special services \(**/
};
.TE
.fi
.SH SEE ALSO
\f4acct\fP(2), \f4exec\fP(2), \f4fork\fP(2).
.sp .2
\f4acct\fP(1M) in the
\f2System Administrator's Reference Manual\f1.
.sp .2
\f4acctcom\fP(1) in the
\f2User's Reference Manual\f1.
.SH NOTES
The
\f4ac_mem\fP
value for a short-lived command gives little information about
the actual size of the command,
because
\f4ac_mem\fP
may be incremented while a different command
(e.g., the shell)
is being executed by the process.
