Unfortunately, I think you're going to find that this is the case. I can probably ask our SA group to see how they're going about it, but I know it at least involves standard Unix process accounting. Where that file is stored (like on a network filesystem or what) and how it is protected I don't know.