#!/usr/local/bin/spar -f
#
# Show noteworthy processes:
#
# Ran as root, but not owned by root, and had a tty (but not sendmail)  *or*
# Owned by root, had a tty, but not 'sh' or 'csh' or sendmail
# Consumed more than 10 minutes of CPU time
#
# To be really useful, much more tailoring needs to be done.
#
priv && user != root && tty != notty && (
	cmd != sendmail
) {print}
user = root && tty != notty && (
	(
         cmd != sh &&
	 cmd != csh &&
         cmd != sendmail
        )
) {print}
cputime > 00:10 {print}
