The Journal - a proposed syslog replacement

I wish to add additional detail to the middle paragraph. The idea is that once attacker enters a machine, there may be a log entry in syslog that shows evidence for it happening, some characteristic error message or whatever.

If the attacker wishes to hide this entry, he must almost immediately take over the logging system before it manages to save the top hash to secure location, because afterwards you can't unnoticeably remove those log entries.