if root users cannot edit logs, the logs can ultimately get too big and fill up the filesystem --- is this what you want? or are you trying to secure the host and suspect some root users to be "less friendly?"