To Log on Not To Log - that is the question

[Justin_Hickey]

i have a rather large access policy and i assume we all do and my philosophy for a long time has been 'Log it all, let the report server sort it out'. The space and processing power needed to do this has grown to an gargantuan level and my manager is giving me the stink eye whenever I asked him for more money for an even larger server. 

I want to be able to run reports nimbly, mostly on what users and internal workstations are up to on the Internet. I also want to get any and all threat data. I dont know if I really care that a web server in the dmz has replicated with the database server for the 17,028th time today. 

So the question is, what is your criteria to log an access policy AND has not logging your more mundane policies ever come back to haunt you? Im assuming when a situations arises I can enable logs for that section and troubleshoot live. Any and all feedback is appreciated. 

Thanks, 

Justin

[JozkoMrkvicka]

Hi, 

We are not logging for example NTP traffic, stealth rule and some other services which are running every second.

Or "log them all" and extend your disk space on log servers