Visit Our UNIX and Linux User Community

Linux and UNIX Man Pages

Linux & Unix Commands - Search Man Pages

acct(5) [netbsd man page]

ACCT(5) 						      BSD File Formats Manual							   ACCT(5)

acct -- execution accounting file SYNOPSIS
#include <sys/acct.h> DESCRIPTION
The kernel maintains the following acct information structure for all processes. If a process terminates, and accounting is enabled, the ker- nel calls the acct(2) function call to prepare and append the record to the accounting file. /* * Accounting structures; these use a comp_t type which is a 3 bits base 8 * exponent, 13 bit fraction ``floating point'' number. Units are 1/AHZ * seconds. */ typedef u_short comp_t; struct acct { char ac_comm[10]; /* name of command */ comp_t ac_utime; /* user time */ comp_t ac_stime; /* system time */ comp_t ac_etime; /* elapsed time */ time_t ac_btime; /* starting time */ uid_t ac_uid; /* user id */ gid_t ac_gid; /* group id */ short ac_mem; /* memory usage average */ comp_t ac_io; /* count of IO blocks */ dev_t ac_tty; /* controlling tty */ #define AFORK 0x01 /* forked but not execed */ #define ASU 0x02 /* used super-user permissions */ #define ACOMPAT 0x04 /* used compatibility mode */ #define ACORE 0x08 /* dumped core */ #define AXSIG 0x10 /* killed by a signal */ char ac_flag; /* accounting flags */ }; /* * 1/AHZ is the granularity of the data encoded in the comp_t fields. * This is not necessarily equal to hz. */ #define AHZ 64 #ifdef KERNEL struct vnode *acctp; #endif If a terminated process was created by an execve(2), the name of the executed file (at most ten characters of it) is saved in the field ac_comm and its status is saved by setting one of more of the following flags in ac_flag: AFORK, ACORE and ASIG. The ASU and ACOMPAT flags are no longer recorded by the system, but are retained for source compatibility. SEE ALSO
lastcomm(1), acct(2), execve(2), accton(8), sa(8) HISTORY
A acct file format appeared in Version 7 AT&T UNIX. BSD
December 22, 2006 BSD

Check Out this Related Man Page

acct.h(3HEAD)							      Headers							     acct.h(3HEAD)

acct.h, acct - per-process accounting file format SYNOPSIS
#include <sys/types.h> #include <sys/acct.h> DESCRIPTION
Files produced as a result of calling acct(2) have records in the form defined by <sys/acct.h>, whose contents are: typedef ushort_t comp_t; /* pseudo "floating point" representation */ /* 3 bit base-8 exponent in the high */ /* order bits, and a 13-bit fraction */ /* in the low order bits. */ struct acct { char ac_flag; /* Accounting flag */ char ac_stat; /* Exit status */ uid_t ac_uid; /* Accounting user ID */ gid_t ac_gid; /* Accounting group ID */ dev_t ac_tty; /* control tty */ time_t ac_btime; /* Beginning time */ comp_t ac_utime; /* accounting user time in clock ticks */ comp_t ac_stime; /* accounting system time in clock ticks */ comp_t ac_etime; /* accounting total elapsed time in clock ticks */ comp_t ac_mem; /* memory usage in clicks (pages) */ comp_t ac_io; /* chars transferred by read/write */ comp_t ac_rw; /* number of block reads/writes */ char ac_comm[8]; /* command name */ }; /* * Accounting Flags */ #define AFORK 01 /* has executed fork, but no exec */ #define ASU 02 /* used super-user privileges */ #define ACCTF 0300 /* record type */ #define AEXPND 040 /* Expanded Record Type - default */ In ac_flag, the AFORK flag is turned on by each fork and turned off by an exec. The ac_comm field is inherited from the parent process and is reset by any exec. Each time the system charges the process with a clock tick, it also adds to ac_mem the current process size, computed as follows: (data size) + (text size) / (number of in-core processes using text) The value of ac_mem/(ac_stime+ac_utime) can be viewed as an approximation to the mean process size, as modified by text sharing. The structure tacct, (which resides with the source files of the accounting commands), represents a summary of accounting statistics for the user id ta_uid. This structure is used by the accounting commands to report statistics based on user id. /* * total accounting (for acct period), also for day */ struct tacct { uid_t ta_uid; /* user id */ char ta_name[8]; /* login name */ float ta_cpu[2]; /* cum. cpu time in minutes, */ /* p/np (prime/non-prime time) */ float ta_kcore[2]; /* cum. kcore-minutes, p/np */ float ta_con[2]; /* cum. connect time in minutes, p/np */ float ta_du; /* cum. disk usage (blocks)*/ long ta_pc; /* count of processes */ unsigned short ta_sc; /* count of login sessions */ unsigned short ta_dc; /* count of disk samples */ unsigned short ta_fee; /* fee for special services */ }; The ta_cpu, ta_kcore, and ta_con members contain usage information pertaining to prime time and non-prime time hours. The first element in each array represents the time the resource was used during prime time hours. The second element in each array represents the time the resource was used during non-prime time hours. Prime time and non-prime time hours may be set in the holidays file (see holidays(4)). The ta_kcore member is a cumulative measure of the amount of memory used over the accounting period by processes owned by the user with uid ta_uid. The amount shown represents kilobyte segments of memory used, per minute. The ta_con member represents the amount of time the user was logged in to the system. FILES
/etc/acct/holidays prime/non-prime time table SEE ALSO
acctcom(1), acct(1M), acctcon(1M), acctmerg(1M), acctprc(1M), acctsh(1M), prtacct(1M), runacct(1M), shutacct(1M), acct(2), exec(2), fork(2) NOTES
The ac_mem value for a short-lived command gives little information about the actual size of the command, because ac_mem may be incremented while a different command (for example, the shell) is being executed by the process. SunOS 5.10 19 May 1994 acct.h(3HEAD)

Featured Tech Videos