(Not OP, but I'll reply anyway.) >Source? You need a reliable kernel exploit, which isn't always easy to download and compile within 15 minutes (or 10 seconds

(Not OP, but I'll reply anyway.) >Source? You need a reliable kernel exploit, which isn't always easy to download and compile within 15 minutes (or 10 seconds, or whatever you set the interval to). But I agree that this is not a very good mitigating factor. >intercept where? If you have root on the box and logs are being sent to another server via syslog, you can intercept the traffic in all sorts of ways. >Source? Read any incident response book or blog. >Point is, thus far they have not, and their first choice was not what the author views as more secure. Yeah, I side with the blog author in this case.