Erik Fair said,

> The process accounting code is old. It's at least as old as 7th Edition
> UNIX (that's where I saw it first, but then I never used V6; it's not in
> the V6 kernel source in the Lion's Book - I just checked), and back then,
> that's how things were done. No one has really felt the need to
> fundamentally change it since then.

If the Sixth Edition manual is to be believed, at that time process
accounting was done by /bin/sh.  This meant /usr/adm/sha had to be
world-writeable and that any processes that weren't run from a shell
didn't show up in the logs.

eric