Incidentally this Dapper paper from Google is an interesting one about using heuristics to decide when to do detailed monitoring/auditing...