Dag Wieers’s Home-Made Tools are some fun sysadmin tools.
In particular, is this bit of coolness: SoapBox. This is an LD_PRELOAD wrapper that monitors and records what changes an application makes to the filesystem. I’ve been looking for something like this for forever. It looks like you can place limits on what the user is allowed to do, too, making this a handy intermediary between a DAC system and going to a full MAC system.
DWall is a shorewall-like iptables front-end. This might be a replacement for shorewall in UMLazi.
DStat is kind of a cross between sar and vmstat/iostat. Might be easier to modify than sar.