introduce an anomaly category in logging
initialize unhook detection before placing our hooks
send tid instead of pid for unhook anomaly
do not log api calls from our unhook detection threads