Some (not all) tools log a "new" event when they are initially turned on.

These events are pretty confusing, especially when trying to determine what tools are actually being used. For example, the Email Archive tool generates a "mail.new" event when the channel is created, but new messages sent to the Email Archive also generate "mail.new" events, so it can become difficult to differentiate between the different events, particularly if the interest is identifying user activity within the system.

Possible solution:
Rename initial log events that occur when the tool is first turned on for a site.
(e.g. when resources tool creates the root folder: content.setup instead of content.new)