Well, I think it's possible to get all the info in a user-space daemon, it would take several kernel calls instead of one. Given the "fast path" nature of the log, that equates directly to worse battery life.
On the other hand, I think the filesystem idea has merit. I wonder if tmpfs has disk quotas? Each app could create it's own file in /dev/shm.
- logging size could be limited by quota
- file owner is proof of ownership
- to log, the application calls gettime() and writes to memory (I assume we don't care if the app lies about time.)
- a daemon periodically reads (and zeros) the logs