To answer your earlier inquiry... in general it should be safe to use both. When paths are passed in plugin configs, we run them through path.join to remove relative relations and double slashes, etc. In all cases (exceptions are bugs), the path should be relative from the plugin directory itself.
Yeah, events.js seems like it should contain the functionality for this. It currently only logs UID, but a lot of those functions should probably log the IP of the triggering party as well.
It seems like the only way to do that is to have IP be a parameter for most of those calls. That's a little tedious.
my fantasy: events are logged to the db as well as flatfile, have severity/importance levels, contain as much info as possible about who triggered it if the logging fn is passed a socket or request object, there's hooks for events of high severity, by default sends email or notification to admins when high-sev occurs