could also add a logging command to the mob's attacks to tally up it's dmg throughout the fight and log it to a different file than the server log... that would make it much easier to parse and see what was going on...
wouldnt suggest implementing a ban feature into said programming... but it would give you a very good idea of who to watch :P cuz lets face it if someone kills cipheron in wos and ciph deals less than like 20k dmg you know something's fishy cuz a raid couldnt even pull that one off
