Re: And thus..
No, because if I can control a process's logging, I can do this, too (note, in this example ONE process wrote this):
[ rogue ] Something innocuous happened
[ fake process ] Something fake happened
How do you keep a rogue process from making a fake tag when the process can match any tagging the logging system uses?