From: guy@Auspex.COM (Guy Harris)
Newsgroups: comp.sys.sun.apps
Subject: Re: tacct.h file - anyone?
Keywords: accounting, tacct
Date: 31 Dec 92 00:30:46 GMT
Organization: Auspex Systems, Santa Clara

>  The file  acct.h  is available in /usr/include, but nowhere is
>  tacct.h  to be found. It is just referred to in the manual -
>  "written on the tacct format"...

Oops.  I forgot to note that the "ACCT(5)" manual page needed to be
updated when I left instructions on how to put the SV accounting stuff
into SunOS.

>  Hopefully someone out there have this one file, and can send it
>  via email or something.

The manual page should have said, as the SV manual page said, that the
"tacct" stuff "resides with the source files of the accounting
commands".  In any case, here's what the SunOS 4.1[.x] ACCT(5) man page
should have said:

.\" @(#)acct.5 1.14 90/02/15 SMI; from UCB 4.2
.TH ACCT 5 "19 October 1987"
.SH NAME
acct \- accounting file formats
.SH SYNOPSIS
.B #include <sys/acct.h>
.SH DESCRIPTION
.IX  "acct"  "\fLacct\fP \(em execution accounting file" "\fLacct\fR"
.IX  "execution accounting file"  ""  "execution accounting file \(em \fLacct\fP"
.IX  "accounting file"  ""  "accounting file \(em \fLacct\fP"
The
.BR acct (2V)
system call makes entries in an accounting file
for each process that terminates.
The accounting file is a sequence of entries whose layout,
as defined by the include file is:
.LP
.RS
.nf
.ft B
typedef	u_short comp_t;

struct  acct
{
	char	ac_flag;		/* Accounting flag */
	char	ac_stat;		/* Exit status */
	uid_t	ac_uid;			/* Accounting user ID */
	gid_t	ac_gid;			/* Accounting group ID */
	dev_t	ac_tty;			/* control typewriter */
	time_t	ac_btime;		/* Beginning time */
	comp_t	ac_utime;		/* Accounting user time */
	comp_t	ac_stime;		/* Accounting system time */
	comp_t	ac_etime;		/* Accounting elapsed time */
	comp_t	ac_mem;			/* average memory usage */
	comp_t	ac_io;			/* chars transferred */
	comp_t	ac_rw;			/* blocks read or written */
	char	ac_comm[8];		/* Accounting command name */
};

#define	AFORK	0001		/* has executed fork, but no exec */
#define	ASU	0002		/* used super-user privileges */
#define	ACOMPAT	0004		/* used compatibility mode */
#define	ACORE	0010		/* dumped core */
#define	AXSIG	0020		/* killed by a signal */
#define	ACCTF	0300		/* record type: 00 = acct */
.ft
.fi
.RE
.LP
The type
.B comp_t
is a 3 bits base 8
exponent, 13 bit fraction ``floating point'' number.
If the process does an
.BR execve (2V),
the first 8 characters of the filename appear in
.BR ac_comm .
.LP
In
.BR ac_flag ,
the
.B \s-1AFORK\s0
is turned on by each
.BR fork (2V)
and turned off by
.BR execve (2V).
.B \s-1ASU\s0
is turned on if a process has super-user privileges and uses them;
.B \s-1AXSIG\s0
is turned on if the process is killed by a signal, and
.B \s-1ACORE\s0
is turned on if the process dumps core as a result.
.LP
The
.B tacct
structure, which resides with the source files of the accounting
commands, represents the total accounting format used by the various
accounting commands:
.LP
.RS
.nf
.ft B
/*
 *	total accounting (for acct period), also for day
 */

struct	tacct	{
	uid_t		ta_uid;		/* userid */
	char		ta_name[8];	/* login name */
	float		ta_cpu[2];	/* cum. cpu time, p/np (mins) */
	float		ta_kcore[2];	/* cum kcore-minutes, p/np */
	float		ta_con[2];	/* cum. connect time, p/np, mins */
	float		ta_du;		/* cum. disk usage */
	long		ta_pc;		/* count of processes */
	unsigned short	ta_sc;		/* count of login sessions */
	unsigned short	ta_dc;		/* count of disk samples */
	unsigned short	ta_fee;		/* fee for special services */
};
.ft
.fi
.RE
.SH SEE ALSO
.BR acctcom (1),
.BR acct (2V),
.BR execve (2V),
.BR fork (2V),
.BR acct (8),
.BR sa (8)
Newsgroups: comp.sys.sun.apps