True, but AFAIK an audit system is worthless if it resides on the same potentially compromised machine, no?