Subject: Re: bin/1302: impossible output from sa(8).
To: der Mouse <mouse@Collatz.McRCIM.McGill.EDU>
From: Simon J. Gerraty <firstname.lastname@example.org>
Date: 08/04/1995 08:48:39
> Ah, but you're forgetting that the process could have been started
> before the accounting period; as long as it _termintes_ during the
> accounting period, you'll see its record. It could have been started
> at any point after the previous boot.
While my syslogs don't back far enough to confirm or deny that, I do
know that the previous occasion aeg was logged in was Jun 17-18, and
that the machine was halted on Jun 28 to install a new UART (16550a)
for the modem. So any process started by aeg in June or earlier would
have be terminated before the July accounting period began.
As I mentioned to another respondent, I've now set the ulimit on cpu
time for users like aeg to 1hr so it certainly cannot legitimately
Oh and yes I do run ps, top etc regularly, so a process consuming 75%
cpu would be noticed.