> What you want is an effectively endless sink for developer logs (Splunk is fine but expensive, ELK is fine but complicated to manage I'm pretty happy with su

> What you want is an effectively endless sink for developer logs (Splunk is fine but expensive, ELK is fine but complicated to manage I'm pretty happy with sumo. A couple things I wish they'd change, but their core competency is searching logs and metrics and they do that really well. It is paid (there is a free tier but we outgrew it quickly) bit it's well worth it IMHO. > But really: focus on removing attack surface, rather than continuously monitoring it. So much this. Logs are great for telling you something bad has already happened and what that was, both security and faults. Reducing the attack service will get you more mileage from a security pov (again, in my opinion). Logs need to he there and some basic trawling of them is also necessary, but is purely reäctive.