Dynamic Virtual segment allocation - finding the cause?

IDS9.30HC5, HP-UX11i One of our hundreds of users has run something that's caused extra virtual segment allocation. Background: The system runs for months on a single Virtual segment of 600Mb, quite happily day and night with up to 300 connections, all running any one of the hundred or so 4gl OLTP programs which are the most used; they generally tend to be enquiry or updates for about a dozen rows, tops (it's a policy administration system). There's some progs that build reports, other stuff like that. Just a couple of times lately, the system has added 6 100Mb (SHMADD size) segments after which the OS has none left so we get an OS error report (over a 15-minute period); obviously some user has run a program or report with a wildcard query that's asked for sort or group space, yes? Trouble is, by the time we get the alert, whatever the rogue is has finished and we can't seem to find out what it was doing it, so we need to somehow jump in early. OK, no big deal, I've now set up a cron which will detect the first new allocation so when it does it again I can be in quick to do some delving. What do I do? (and don't start me on onmode -F on HP-UX!!!!!!!!!!) First off is onstat -g seg to find the address of the new segment, no problem. But once I've done that, what's the next move? I'm guessing onstat -g mem and find out what processes have a pool starting within that new segment? Also, there's onstat -g afr when I've found a likely target, but I don't know what the "memid" identifiers mean - there's fragman, osenv, sqscb,osenvgentcb and so on but I can't find definitions for these. TIA Malc