After Adam's mini-presentation on classic UNIX system accounting (sa, lastcomm) at the October meeting, I decided to set it up on various Linux and MacOS X systems I maintain. I came across a curious issue under MacOS X, where timestamps were correct for root processes, but wrong for everyone else. Turns out, I'm not alone in noticing this...

http://unix.stackexchange.com/questions/206815/system-accounting-misbehaviou...

I haven't found any solution to this, nor anything from Apple documenting this. I imagine this is not likely to be a priority issue for anyone, though.