> Ah, but you're forgetting that the process could have been started
> before the accounting period; as long as it _termintes_ during the
> accounting period, you'll see its record.  It could have been started
> at any point after the previous boot.

While my syslogs don't back far enough to confirm or deny that, I do
know that the previous occasion aeg was logged in was Jun 17-18, and
that the machine was halted on Jun 28 to install a new UART (16550a)
for the modem.  So any process started by aeg in June or earlier would
have be terminated before the July accounting period began.

As I mentioned to another respondent, I've now set the ulimit on cpu
time for users like aeg to 1hr so it certainly cannot legitimately
happen again.

Oh and yes I do run ps, top etc regularly, so a process consuming 75%
cpu would be noticed.

--sjg