We are using Command Oriented ArchitectureInterface/Architecture to audit user activity.
It means that requests to the server, cause the server side to instantiate instances of classes that represent commands (atomic actions the user can preform).
For instance, lets say the user makes a purchase in an item store:
//We could have done something like
someShop.sell(item, player); // This function deducts money from the player
// and stores the new item in their inventory
//Instead we do this:
$buyItemCmd = new BuyItemCommand(item); // The player is already known from the sessionId
$cmdExecuter.run($buyItemCmd);
Now we add logging / auditing features in the cmdExecuter
that apply to all commands. This way there is little to no code duplication and we can turn off auditing, either by re-configuring a specific command class constants and / or modifying the cmdExecuter.
It helps to keep things organize. We currently create a database record for each "important" command. This helps track behavior that is interesting to us.
Further Reading
Command-Oriented Inteface by Martin Fowler