man(1) Manual page archive

     ACCT(5)                                                   ACCT(5)

          acct - execution accounting file

          #include <sys/types.h>
          #include <sys/acct.h>

          Acct(2) causes an entry to be appended to an accounting file
          for each process that terminates.  The layout of an account-
          ing file entry, as given in <sys/acct.h>, is

          typedef unsigned short comp_t;

          struct  acct
                  char   ac_comm[10];  /* command name */
                  comp_t ac_utime;     /* user time */
                  comp_t ac_stime;     /* system time */
                  comp_t ac_etime;     /* elapsed time */
                  time_t ac_btime;     /* beginning time */
                  short  ac_uid;       /* user ID */
                  short  ac_gid;       /* group ID */
                  short  ac_mem;       /* average memory usage */
                  comp_t ac_io;        /* number of disk IO blocks */
                  dev_t  ac_tty;       /* control typewriter */
                  char   ac_flag;      /* flag */

          Values in ac_flag:

          #define AFORK  01            /* has executed fork, but no exec */
          #define ASU    02            /* used super-user privileges */

          If the process does an exec(2), the first 10 characters of
          the filename appear in `ac_comm.'

          The type comp_t counts 60- or 50-cycle clock ticks in a pri-
          vate floating-point format: a three-bit base-8 exponent and
          a 13-bit unsigned mantissa.  Thus the number of clock ticks
          that a process ran is expressed by
          (ac_etime&017777)<<((ac_etime>>13)&03). The beginning time,
          ac_btime, is recorded in the format of time(2).

          acct(2), sa(8)