At 0:38 -0700 6/17/97, Martin Husemann wrote:
>> Probably if some part of accounting task is moved to user space, the
>> chance to lose data may increase.
>
>I wonder why accounting is written inside the kernel at all - why not
>just queue it on some accounting device (like syslog) and drop data
>whenever the (user configurable) output buffer overflows?


The process accounting code is old. It's at least as old as 7th Edition
UNIX (that's where I saw it first, but then I never used V6; it's not in
the V6 kernel source in the Lion's Book - I just checked), and back then,
that's how things were done. No one has really felt the need to
fundamentally change it since then.

The only thing I'd add to the acct structure myself is the dev_t of the
device the command was run from, to make it harder to lie to the accounting
code about what command was run.

	Erik Fair <fair@clock.org>