Martin Husemann writes:
> > Probably if some part of accounting task is moved to user space, the
> > chance to lose data may increase.
> 
> I wonder why accounting is written inside the kernel at all - why not
> just queue it on some accounting device (like syslog) and drop data 
> whenever the (user configurable) output buffer overflows?

Probably makes considerable sense. Does everyone agree?

Perry