[sudo-sys] What should we monitor?