acct(5) File Formats Manual acct(5)Name
acct - execution accounting file
Syntax
#include <sys/acct.h>
Description
The system call makes entries in an accounting file for each process that terminates. The accounting file is a sequence of entries whose
layout, as defined by the include file, is:
typedef u_short comp_t
struct acct
{
char ac_comm[10]; /* Accounting command name */
comp_t ac_utime; /* Accounting user time */
comp_t ac_stime; /* Accounting system time */
comp_t ac_etime; /* Accounting elapsed time */
time_t ac_btime; /* Beginning time */
short ac_uid; /* Accounting user ID */
short ac_gid; /* Accounting group ID */
short ac_mem; /* average memory usage */
comp_t ac_io; /* number of disk IO blocks */
dev_t ac_tty; /* control typewriter */
char ac_flag; /* Accounting flag */
};
#define AFORK 0001 /* has executed fork, but no exec */
#define ASU 0002 /* used super-user privileges */
#define ACOMPAT 0004 /* used compatibility mode */
#define ACORE 0010 /* dumped core */
#define AXSIG 0020 /* killed by a signal */
#define AHZ 64 /* the accuracy of data is 1/AHZ */
#ifdef KERNEL
struct acct acctbuf;
struct gnode *acctp;
#endif
If the process does an the first 10 characters of the file name appear in ac_comm. The accounting flag contains bits indicating whether
was ever accomplished and whether the process ever had superuser privileges.
See Alsoacct(2), execve(2), sa(8)
RISC acct(5)
Check Out this Related Man Page
acct(4) Kernel Interfaces Manual acct(4)NAME
acct - per-process accounting file format
SYNOPSIS DESCRIPTION
Files produced as a result of calling (see acct(2)) have records in the form defined by whose contents are:
typedef ushort comp_t; /* "floating point":
13-bit fraction, 3-bit exponent */
struct acct {
char ac_flag; /* Accounting flag */
char ac_stat; /* Exit status */
uid_t ac_uid; /* Accounting user ID */
gid_t ac_gid; /* Accounting group ID */
dev_t ac_tty; /* control typewriter */
time_t ac_btime; /* Beginning time */
comp_t ac_utime; /* acctng user time in clock ticks */
comp_t ac_stime; /* acctng system time in clock ticks */
comp_t ac_etime; /* acctng elapsed time in clock ticks */
comp_t ac_mem; /* memory usage in clicks */
comp_t ac_io; /* chars trnsfrd by read/write */
comp_t ac_rw; /* number of block reads/writes */
char ac_comm[8]; /* command name */
};
#define AFORK 01 /* has executed fork, but no exec */
#define ASU 02 /* used super-user privileges */
#define ACCTF 0300 /* record type: 00 = acct */
In the flag is turned on by each and turned off by an (see fork(2) and exec(2)). The field is inherited from the parent process and is
reset by any Each time the system charges the process with a clock tick, it also adds to the current process size, computed as follows:
(data size) + (text size) + (number of in-core processes sharing text) +
sum of ((shared memory segment size) / (number of in-core processes attached to segment))
For systems with virtual memory, the text, data, and shared memory sizes refer to the resident portion of the memory segments. The value
of can be viewed as an approximation to the mean process size, as modified by text-sharing.
The structure, which resides with the source files of the accounting commands, represents the total accounting format used by the various
accounting commands:
WARNINGS
The value for a short-lived command gives little information about the actual size of the command because can be incremented while a dif-
ferent command (such as the shell) is being executed by the process.
Kernel internal structures may change from release to release without warning. Applications directly relying on these structures are not
supported.
Accounting files are currently written in 32-bit format. Thus, 64-bit applications which read the files need to make special provisions.
In particular, the header declares the field as rather than a in 64-bit compilations. The field should be cast to in the application
before using it (e.g., in calls to date conversion functions). The accounting file format will be changed to a 64-bit layout at a future
release.
SEE ALSO acct(2), acct(1M), acctcom(1M), exec(2), fork(2).
STANDARDS CONFORMANCE acct(4)