Event logs should have the name of the operator who initiated the action when applicable.

[MrsTonedOne]

In fact, a generic command issued event with this info might be the most appropriate.

[Cyberboss]

Every set of actions a user takes is preceded by an audit entry in the logs saying "Access from X". Another one of these only pops up when a different user takes an action. I agree though, it should be attached directly to the individual logs.