Hacker News Reader

Could you tell us more about how you did your auditing? Did you add more logging?

Yap it was done using the logging facility with a separate rotation, log forwarding rules, and such.