Syslog being down for seconds is not obvious, on the other hand it's very easy to say... inject into syslogd to hide your modifications in real time. I hook libc functions using trampolines to write LD_PRELOAD rootkits myself. I just don't get the point, it seems like a really shitty half-measure.

Your hashes don't have to match anything. This does not apply. You can just recreate the entire syslog database.

It doesn't really make logging more secure, you can easily just modify the entire log. Plus if someone's modifying your logs they have root permissions on your machine and then you cannot trust your system, they can put hooks on the log read to just hide certain entries if necessary. The only real solution is to NOT trust your own system - send all the data to a remote syslog server with no other services running. Why take a half-measure when you should have gone all the way?

Not to mention IntelliJ is an interolerable piece of shit compared to Eclipse.

Try a modern tiling WM, Xmonad is quite nice :)

Get a better crack. http://warez-bb.org/ should be able to help you