acct(4) Kernel Interfaces Manual acct(4)
NAME
acct, acct.h - Accounting include files
SYNOPSIS
#include <sys/acct.h>
#include <utmp.h>
DESCRIPTION
The /usr/include/sys/acct.h header file defines a type acct structure for accounting information used by various accounting files. The
information in the acct.h structure is used in records in accounting files having various fixed formats.
The various accounting files provide the means to monitor system use and performance and to pass charges to system users. These accounting
files also serve as the permanent record of billing information for each process, CPU real time, allocated resources, and services. The
acct command is used to produce desired accounting files.
The /usr/include/utmp.h header file defines the record format for data written to the /var/adm/wtmp accounting login/logout database file
whenever any user logs in or out. The type utmp structure defined in the /usr/include/utmp.h header file has the following members: The
user login name listed in the /etc/passwd file. The user identification from the /etc/inittab ID file. The device name (console or tty43,
for example). This is a flag that defines the type of entry. The type of entry flag symbolic names are as follows: No valid entry. Run
level changed by the init program. Boot time entry, generated by the init program. Used by the date program when the system time is
changed. Used by the date program when the system time is changed. Process spawned by the init program. A getty process waiting for
login. A user process. Terminated process. Private flag for accounting programs. Process ID number. Process termination status of a
process whose ut_type member value is DEAD PROCESS. Process exit status of a process whose ut_type member value is DEAD PROCESS. Time
that entry was made. Host machine name.
The /usr/include/sys/acct.h header file defines the record format for the data written to the process accounting database file when a
process completes. The type acct structure defined in the acct.h header file contains the following members: An accounting flag for the
process for which the accounting record is written. The accounting flag symbolic names are as follows: The process has been created using a
fork() system call, but an exec() system call has not yet concluded. The exec() system call resets the AFORK flag. The ASU Command was run
with an effective user-id of 0. Dumped core. Process killed by a signal. Exit status. A flag that indicates how the process terminated.
The user ID of the process for which the accounting record is written. The group ID of the process for which the accounting record is
written. The terminal from which the process was started. Beginning time. The time at which the process began. The amount of user time
(in a compressed format) used by the process. The amount of system time (in a compressed format) used by the process. The amount of
elapsed time (in a compressed format) since the command ran. The average amount of memory in units of 8KB that is used by the process.
The number of characters (in a compressed format) transferred by the process. The number of blocks (in a compressed format) read or writ-
ten by the process. The name of the command that was used to start the process. A child process created by a fork() system call receives
up to 8 bytes from the parent process. An exec() system call changes the name in this field.
Compressed data, which is a condensed floating-point representation, may be expanded to normal floating point by using the expacct() rou-
tine.
The type tacct structure, which is not a part of the /usr/include/utmp.h or the /usr/include/sys/acct.h header file definitions, is defined
in a private tacct.h header file. The type tacct structure members define a format for storage of all information available from both the
/var/adm/wtmp login/logoff and /var/adm/pacct process accounting databases, whose members are used by various accounting commands to pro-
duce an output file to be used in an accounting report (see the acctmerg command). Members of the type tacct structure whose data types are
specified as an array of two double elements have both prime-time and non-prime time values. The type tacct structure has the following
members: User ID. A field for the login name having the same number of characters NSZ as the ut_user member of the utmp structure. Cumu-
lative CPU time in minutes. Cumulative Kcore minutes. Cumulative number of characters transferred in blocks of 512 bytes. Cumulative
number of blocks read and written. Cumulative connect time in minutes. Cumulative disk usage time in minutes. Queueing system (printer)
fee in number of pages. Special services fee. A count of the number of processes. A count of the number of login sessions. A count of
the number of disk samples.
FILES
Accounting header files that define formats for writing accounting files. The active login/logoff database file. The active process
accounting database file.
RELATED INFORMATION
Commands: acct(8), acctcms(8), acctcom(8), acctcon(8), acctdisk(8), acctmerg(8), acctprc(8), runacct(8), sa(8).
Functions: acct(2), fork(2), exec(2), expacct(3). delim off
acct(4)