Yes, an IDS can't log everything,
Wrong, Niksun NetDetector does. It can take new signatures and retro-actively deploy them, reconstruct sessions, showing all commands, files that were uploaded, etc...Waaaay cool...You of course pay dearly for it, but nice...

/nebulus