Looks like pam_tty_audit in Linux (http://www.slashzero.com/2009/11/shell-session-logging/) could have been a great way to help figure out "what happened!" when one gets rooted.
I say "could have been" because the rootkits do clean logs and kill remote logging before they do anything else.
Say I know that some of my OpenVZ containers get rooted and I trust that my OpenVZ hardware root did not. Could I have audited from the OpenVZ hardware node on all the TTYs of the containers?