Process accounting usually logs to a binary file at, say, /var/adm/pacct, which is usually system- or root-owned and kept secure.

What do you mean by "spoofed"?

Contact your SA or check a book on process accounting for details about various implementations you can use. This is somewhat non-Perl.