[ale] diagnosis

[Doug McNash]

> Thinking about your post and the mention of the /var/run/utmp existing for the 
>   leak to occur, led me to the man page for utmp to remind myself what wrote 
> to it or manipulated it.  Going back to your first post on April 7 I can see 
> that you have only the kernel processes, init, bash, and portmap running.  So 
> based on this I would start dissecting init and the kernel. 

Specifically look for a process `respawned` in /etc/inittab, probabaly
opening a tty or pty.  Now that Dow mentions init/utmp together the
explanation seems be that you have a process starting in inittab that is
terminating abnormally then restarting over and over.  You should see a
respawning to rapidly messages in the logs but it could be happening
below the threshold for that warning.