jtmoon79/super-speedy-syslog-searcher

`acct` fixedstruct needs special handling for `comp_t` and "clock tick" values

Opened this issue · 0 comments

clock tick fields

From man acct

The ac_utime, ac_stime, and ac_etime fields measure time in "clock ticks"; divide these values by sysconf(_SC_CLK_TCK) to convert them to seconds.

comp_t fields

File format acct has field type comp_t that needs special handling

From man acct

The comp_t data type is a floating-point value consisting of a 3-bit, base-8 exponent, and a 13-bit mantissa.
A value, c, of this type can be converted to a (long) integer as follows:
v = (c & 0x1fff) << (((c >> 13) & 0x7) * 3);

From file fixedstruct.rs

//       /*
//        * Accounting structures; these use a comp_t type which is a 3 bits base 8
//        * exponent, 13 bit fraction ``floating point'' number.  Units are 1/AHZ
//        * seconds.
//        */
set_buffer_at_or_err_number!(buffer, at, acct.ac_utime, netbsd_x8632::comp_t);

Currently, a comp_t is displayed as 16-bit integer.