Following up on James's description of the "papertrail" ssh audit traces
that the diego-ssh support is adding.

This is very useful to have these traces. Can you confirm these traces are
provided through loggregator (and don't appear in the cc events) ? I'm
however wondering how reliable can the loggregator-based logs be (as
loggregator is lossy and not designed to support reliable transport of
logs). While I understand there have been recent efforts to reduce the
lossy rate of loggregator, I'm wondering how easy it would be for a CF user
to cover its tracks (i.e. its "diego ssh" log entries), e.g. simply
flooding the loggregator with user traffic (having RTR and diego compete
for throughput into loggregator for a given app).

Thanks,

Guillaume.