acct File Format

Purpose

Provides the accounting file format for each process.

Description

The accounting files provide a means to monitor the use of the system. These files also serve as a method for billing each process for processor usage, materials, and services. The acct system call produces accounting files. The /usr/include/sys/acct.h file defines the records in these files, which are written when a process exits.

The acct structure

The acct structure in the acct.h header file contains the following fields:

Item Description
ac_flag Specifies one of the following accounting flags for the process for which the accounting record is written:
AFORK The process was created using a fork command but an exec subroutine has not yet followed. The exec subroutine turns off the AFORK flag.
ASU The process used root user authority.
ac_stat Specifies the exit status. A flag that indicates how the process terminated.
ac_uid Specifies the user ID of the process for which the accounting record is written.
ac_gid Specifies the group ID of the process for which the accounting record is written.
ac_tty Specifies the terminal from which the process was started.
ac_wlmkey Holds a 64-bit numeric key representing the Workload Manager class to which the process belonged. The Workload Manager Application Programming Interface provides the wlm_key2class subroutine to convert the key back to a class name.
ac_btime Specifies the beginning time. The time at which the process started.
ac_utime Specifies the amount of user time, in seconds, used by the process.
ac_stime Specifies the amount of system time, in seconds, used by the process.
ac_etime Specifies the amount of time, in seconds, elapsed since the command ran.
ac_mem Specifies the average amount of memory used by the process. Every clock interrupt (or clock tick,100 times per second), the sys_timer routine is called to update the user data for the current process. If the process is in user mode, both its u_utime value and memory usage values are incremented; otherwise, only its u_stime value is incremented. The sys_timer routine calls the vms_rusage routine to obtain the kilobytes of real memory being used by TEXTSEG (#1), the PRIVSEG (#2), and the big-data segments (#3-11), if used. These values are added to the total memory usage value at each clock tick during which the process is not in kernel mode. When the process ends, the acctexit routine computes how many clock ticks occurred while the process executed (in both user and kernel modes) and divides the total memory usage value by this number to give an average memory usage for the process. This value is recorded as a two-byte unsigned short integer.
ac_io Specifies the number of characters transferred by the process.
ac_rw Specifies the number of blocks read or written by the process.
ac_comm Specifies the name of the command that started the process. A child process created by a fork subroutine receives this information from the parent process. An exec subroutine resets this field.

The tacct Structure

The tacct structure, which is not part of the acct.h header file, represents the total accounting format used by the various accounting commands:

struct tacct {
       uid_t ta_uid;          /* user-ID */
       char ta_name[8];       /* login name */
       float ta_cpu[2];       /* cum. CPU time, p/np (mins) */
       float ta_kcore[2];     /* cum. kcore-mins, p/np */
       float ta_io[2];        /* cum. chars xferred (512s) */
       float ta_rw[2];        /* cum. blocks read/written */
       float ta_con[2];       /* cum. connect time, p/np, mins */
       float ta_du;           /* cum. disk usage */
       long ta_qsys;          /* queuing sys charges (pgs) */
       float ta_fee;          /* fee for special services */
       long ta_pc;            /* count of processes */
       unsigned short ta_sc;  /* count of login sessions */
       unsigned short ta_dc;  /* count of disk samples */
};