[devicenull]

You should consider hooking the log command, and preventing it from being disabled once logging has been activated. Most of the exploit scripts I'm seeing disable logging as a way to prevent admins from determining what has happened.