Requested / suggested by @bdarnell

i don't think i agree that fsyncing after every log entry is a requirement
i'm worried about the DoS possibilities of allowing attackers to consume a scarce resource like this, and about the SPOF of a single disk
(i feel the same way about our existing experimental audit logs, fwiw)
requiring synced writes to a single disk is just an awkward spot in the durability spectrum. if it's really important, it needs to be replicated

In other words, durability for audit logs should be achieved via network logging, not disk syncs.