acct, acct.h - Accounting include files
The /usr/include/sys/acct.h header file defines a type acct structure for
accounting information used by various accounting files. The information in
the acct.h structure is used in records in accounting files having various
The various accounting files provide the means to monitor system use and
performance and to pass charges to system users. These accounting files
also serve as the permanent record of billing information for each process,
CPU real time, allocated resources, and services. The acct command is used
to produce desired accounting files.
The /usr/include/utmp.h header file defines the record format for data
written to the /var/adm/wtmp accounting login/logout database file whenever
any user logs in or out. The type utmp structure defined in the
/usr/include/utmp.h header file has the following members:
The user login name listed in the /etc/passwd file.
The user identification from the /etc/inittab ID file.
The device name (console or tty43, for example).
This is a flag that defines the type of entry. The type of entry
flag symbolic names are as follows:
EMPTY No valid entry.
RUN_LVL Run level changed by the init program.
BOOT_TIME Boot time entry, generated by the init program.
OLD_TIME Used by the date program when the system time is
NEW_TIME Used by the date program when the system time is
Process spawned by the init program.
A getty process waiting for login.
A user process.
Private flag for accounting programs.
Process ID number.
Process termination status of a process whose ut_type member
value is DEAD PROCESS.
Process exit status of a process whose ut_type member value is
Time that entry was made.
Host machine name.
The /usr/include/sys/acct.h header file defines the record format for the
data written to the process accounting database file when a process com-
pletes. The type acct structure defined in the acct.h header file contains
the following members:
An accounting flag for the process for which the accounting
record is written. The accounting flag symbolic names are as fol-
AFORK The process has been created using a fork() system
call, but an exec() system call has not yet concluded.
The exec() system call resets the AFORK flag.
ASU The ASU Command was run with an effective user-id of 0.
ACORE Dumped core.
AXSIG Process killed by a signal.
Exit status. A flag that indicates how the process terminated.
The user ID of the process for which the accounting record is
The group ID of the process for which the accounting record is
The terminal from which the process was started.
Beginning time. The time at which the process began.
The amount of user time (in a compressed format) used by the pro-
The amount of system time (in a compressed format) used by the
The amount of elapsed time (in a compressed format) since the
The average amount of memory in units of 8KB that is used by the
The number of characters (in a compressed format) transferred by
The number of blocks (in a compressed format) read or written by
The name of the command that was used to start the process. A
child process created by a fork() system call receives up to 8
bytes from the parent process. An exec() system call changes the
name in this field.
Compressed data, which is a condensed floating-point representation, may be
expanded to normal floating point by using the expacct() routine.
The type tacct structure, which is not a part of the /usr/include/utmp.h or
the /usr/include/sys/acct.h header file definitions, is defined in a
private tacct.h header file. The type tacct structure members define a for-
mat for storage of all information available from both the /var/adm/wtmp
login/logoff and /var/adm/pacct process accounting databases, whose members
are used by various accounting commands to produce an output file to be
used in an accounting report (see the acctmerg command). Members of the
type tacct structure whose data types are specified as an array of two dou-
ble elements have both prime-time and non-prime time values. The type tacct
structure has the following members:
A field for the login name having the same number of characters
NSZ as the ut_user member of the utmp structure.
Cumulative CPU time in minutes.
Cumulative Kcore minutes.
Cumulative number of characters transferred in blocks of 512
Cumulative number of blocks read and written.
Cumulative connect time in minutes.
Cumulative disk usage time in minutes.
Queueing system (printer) fee in number of pages.
Special services fee.
A count of the number of processes.
unsigned short ta_sc
A count of the number of login sessions.
unsigned short ta_dc
A count of the number of disk samples.
Accounting header files that define formats for writing account-
The active login/logoff database file.
The active process accounting database file.
Commands: acct(8), acctcms(8), acctcom(8), acctcon(8), acctdisk(8),
acctmerg(8), acctprc(8), runacct(8), sa(8).
Functions: acct(2), fork(2), exec(2), expacct(3).