There's a free version of Splunk that does an internal count (something like 100mb/day) for demo purposes. If one is savvy enough to override that, then I'd also assume one is savvy enough to fake the records when the license police come calling.

I can't be the only one that finds it very disquieting that you have to give a company access to your internal network so they can perform antipiracy checks.