Your level of paranoia may vary. There are also several alternatives you can use to standard syslogd. PEO-1 that allows the remote auditing of system logs. For you NT users, they also have a Windows version, called slogger . There is also syslog-ng, developed by BalaBit Software, which is similiar in use to ssyslog, but uses SHA1 instead.
All versions are free and open source.
I run a sniffer on the firewall that sniffs any traffic going to or from the honeypot. Since the honeypot is isolated by the firewall, you know all traffic goes through the firewall. This way you see exactly what the black-hat is seeing. A disadvantage is the black-hat can hide his moves with encryption, such as ssh. However, if you are not running any such services on your honeypot, the blackhat may not use them.