Since you log successful logins/logouts, have you considered adding failed login attempts?
Also, is there a way to network-activate with certain options pre-configured to be tracked, so we dont have to configure each blog's audit trail when the blog is created?
