acct(5) [mojave man page]

ACCT(5) 						      BSD File Formats Manual							   ACCT(5)

NAME

     acct -- execution accounting file

SYNOPSIS

     #include <sys/acct.h>

DESCRIPTION

     The kernel maintains the following acct information structure for all processes. If a process terminates, and accounting is enabled, the ker-
     nel calls the acct(2) function call to prepare and append the record to the accounting file.

     /*
      * Accounting structures; these use a comp_t type which is a 3 bits base 8
      * exponent, 13 bit fraction ``floating point'' number.  Units are 1/AHZ
      * seconds.
      */
     typedef u_short comp_t;

     struct acct {
	     char    ac_comm[10];    /* name of command */
	     comp_t  ac_utime;	     /* user time */
	     comp_t  ac_stime;	     /* system time */
	     comp_t  ac_etime;	     /* elapsed time */
	     time_t  ac_btime;	     /* starting time */
	     uid_t   ac_uid;	     /* user id */
	     gid_t   ac_gid;	     /* group id */
	     short   ac_mem;	     /* memory usage average */
	     comp_t  ac_io;	     /* count of IO blocks */
	     dev_t   ac_tty;	     /* controlling tty */
     #define AFORK   0x01	     /* forked but not execed */
     #define ASU     0x02	     /* used super-user permissions */
     #define ACOMPAT 0x04	     /* used compatibility mode */
     #define ACORE   0x08	     /* dumped core */
     #define AXSIG   0x10	     /* killed by a signal */
	     char    ac_flag;	     /* accounting flags */
     };

     /*
      * 1/AHZ is the granularity of the data encoded in the comp_t fields.
      * This is not necessarily equal to hz.
      */
     #define AHZ     64

     #ifdef KERNEL
     struct vnode    *acctp;
     #endif

     If a terminated process was created by an execve(2), the name of the executed file (at most ten characters of it) is saved in the field
     ac_comm and its status is saved by setting one of more of the following flags in ac_flag: AFORK, ASU, ACOMPAT, ACORE and ASIG.

SEE ALSO

     lastcomm(1), acct(2), execve(2), accton(8), sa(8)

HISTORY

     A acct file format appeared in Version 7 AT&T UNIX.

BSD
								   June 5, 1993 							       BSD

acct(4) 						     Kernel Interfaces Manual							   acct(4)

NAME

       acct - per-process accounting file format

SYNOPSIS

DESCRIPTION

       Files produced as a result of calling (see acct(2)) have records in the form defined by whose contents are:

	      typedef ushort comp_t; /* "floating point":
					     13-bit fraction, 3-bit exponent */
	      struct  acct {
		  char	  ac_flag;	  /* Accounting flag */
		  char	  ac_stat;	  /* Exit status */
		  uid_t   ac_uid;	  /* Accounting user ID */
		  gid_t   ac_gid;	  /* Accounting group ID */
		  dev_t   ac_tty;	  /* control typewriter */
		  time_t  ac_btime;	  /* Beginning time */
		  comp_t  ac_utime;	  /* acctng user time in clock ticks */
		  comp_t  ac_stime;	  /* acctng system time in clock ticks */
		  comp_t  ac_etime;	  /* acctng elapsed time in clock ticks */
		  comp_t  ac_mem;	  /* memory usage in clicks */
		  comp_t  ac_io;	  /* chars trnsfrd by read/write */
		  comp_t  ac_rw;	  /* number of block reads/writes */
		  char	  ac_comm[8];	  /* command name */
	      };
	      #define AFORK   01	  /* has executed fork, but no exec */
	      #define ASU     02	  /* used super-user privileges */
	      #define ACCTF   0300	  /* record type: 00 = acct */

       In  the	flag  is  turned on by each and turned off by an (see fork(2) and exec(2)).  The field is inherited from the parent process and is
       reset by any Each time the system charges the process with a clock tick, it also adds to the current process size, computed as follows:

	      (data size) + (text size) + (number of in-core processes sharing text) +
	      sum of ((shared memory segment size) / (number of in-core processes attached to segment))

       For systems with virtual memory, the text, data, and shared memory sizes refer to the resident portion of the memory segments.	The  value
       of can be viewed as an approximation to the mean process size, as modified by text-sharing.

       The  structure,	which resides with the source files of the accounting commands, represents the total accounting format used by the various
       accounting commands:

WARNINGS

       The value for a short-lived command gives little information about the actual size of the command because can be incremented while  a  dif-
       ferent command (such as the shell) is being executed by the process.

       Kernel  internal  structures may change from release to release without warning.  Applications directly relying on these structures are not
       supported.

       Accounting files are currently written in 32-bit format.  Thus, 64-bit applications which read the files need to make  special  provisions.
       In  particular,	the  header  declares  the  field as rather than a in 64-bit compilations.  The field should be cast to in the application
       before using it (e.g., in calls to date conversion functions).  The accounting file format will be changed to a 64-bit layout at  a  future
       release.

SEE ALSO

       acct(2), acct(1M), acctcom(1M), exec(2), fork(2).

STANDARDS CONFORMANCE

																	   acct(4)