This feature requires an I/O log. After the specified number of minutes, a message is written to the log server’s syslog. This message allows variable substitution using the %variable% syntax. Any variable recorded in the Accept event can be incorporated into the message. When the finish event is logged, the new timelimitexceeded variable is set to 1. If the time limit is not exceeded, the timelimitexceeded variable is not recorded in the finish event. If the optional message argument is not specified, the default message is: user:%user% exceeded time limit as %runuser%@%runhost% for %runargv%

Internally, this feature makes use of the new read-only policy variables runtimewarnlog and runtimewarnlogmsg to communicate the details from the policy server to the run host.

This feature might typically be used to create log entries of the longer sessions, possibly after warning a user using runtimewarn() of an upcoming timeout specified by the runtimelimit variable.

The runtimewarnlog time limit is specified in minutes (within a procedure), while runtimeout is specified in seconds (as a variable).
runtimewarnlog( minutes [, message] );
Minutes Required positive integer specifying the timeout in minutes.
Message Optional string specifying a message to syslog on the log server.
runtimewarnlog(20, "user:%user% exceeded session time limit");

For more information, please see the following: