the biggest one for me is accurate user attribution, which is hard when people are SU-ing to root