Sometimes you aren't looking for history because you expect someone did something wrong on purpose. Bash keeps a history when you are shelled, why not whm?
Sometimes you are just backtracking to try to figure out how something happened. The situation where it came up was because this particular machine changed it's primary IP seemingly randomly.
I had to force the ip route table to fix it and noone had been shelled into the box for days when it happened, so we have to assume it was a mistake on the part of one of 5 people who could of logged into the whm and I wanted to see what whm had done that might of made that change.
I'd like to see whm writing to it's own log file or even to /var/log/messages with IP login and command every time it does something.