The event service, so the event log can be re-directed. There are alarm and event logs on every switch (which you can check to see who has done what) – this can be re-directed to a secure server.
The time service (time is taken from the principal switch). This is quite useful as it can be used to correlate events happening on different parts of your fabric.
We want to protect the Management Services. If we have access to the Management Services, we have access to all of the information irrespective of zone.