How do you attribute the 50% sys usage to that one process? That is for all processes is it not? BTW - when ANY process runs it spends time in kernel code (sys) when invoking a syscall, .e.g. open(). That means vmstat and sar would normally show a summed % sys for all processes system wide.

Doesn't mean that the daemon is or is not using most of that %.