Veritas™ File System 5.0.1 Programmer's Reference Guide

The aggregation considers values only from the latest record from records with
the same lastreset time and then sums up the number of reads for each such
record.
fcl_acsinfo structure
When tracking access-info is enabled, VxFS logs the access information such as:
■ The real and effective user and group ID of the accessing application
■ The node from where the file was accessed
■ The process id of the user application along with each record
When the application reads the FCL, the information is returned in the fr_acsinfo
field.
The fr_acsinfo points to an FCL_acsinfo structure, defined as follows:
struct fcl_acsinfo {
uint32_tfa_ruid;
uint32_tfa_rgid;
uint32_tfa_euid;
uint32_tfa_egid;
uint32_tfa_pid;
uint32_tfa_nodeid;
};
Note: The accessinfo is not returned as a separate record type but as additional
information along with the other records. In addition, the accessinfo information
is not always present with every record (for example, when tracking accessinfo
is not enabled). However, even when accessinfo is enabled in some file system
internal operations (for example, truncating a file when it is removed), the access
information may not be present. To help determine if access information is
available, the FCL record contains a flag called fcl_acsinfovalid which is
non-zero only if the accessinfo is present with a particular record.
Several of the fields in the fcl_acsinfo structure are pointers and need memory
to store the actual contents. This is handled by storing the actual data immediately
after the FCL record, and updating the pointer to point to the data. The record
length fr_reclen field is updated to account for the whole data. Thus, each FCL
record returned by vxfs_fcl_read is a variable size record, whose length is
indicated by fr_reclen_field.
Figure 2-3 illustrates how the data is laid out in a sample link record.
39File Change Log
Application programming interface for File Change Log