> If so, then why isn't this already a feature in common Linux distros? It is. It's called auditd, is quite possibly already installed (albeit probably not con

> If so, then why isn't this already a feature in common Linux distros? It is. It's called auditd, is quite possibly already installed (albeit probably not configured to do much), and can easily ship its logs off to another host (natively or via syslogd).