High-volume logs can hide high-value events
Collecting everything sounds thorough and can make the important events harder to find, not easier.
Volume drives cost, slows queries and buries the handful of entries that matter among millions that do not. More data is not automatically more visibility. The useful question is which questions you need to be able to answer, and whether you are collecting what answers them, rather than how many events per second you ingest.
More on Logging and telemetry
- A log records an observation, not objective truthThe shadow, not the thing
- Central logging reduces local erasure riskIt left before you got there
- Verbose logging can leak secretsEverything, including that
- Retention determines how far back you can investigateThe line only goes back so far
- Telemetry coverage should map to detection questionsPoint it at the question
- Parsing errors can silently break detectionsSilence is not the same as clear