Log data often provides important information that aids in detecting security incidents. However, filtering out relevant messages from the large amount of different log events presents a particular challenge. This is because numerous log events are only informative in nature and divert attention from messages that are actually important. If too many log events are selected, analysing all their information will be difficult and require a great deal of time.

Furthermore, log events can be discarded or overwritten if the RAM or hard drive capacity of the IT system or logging infrastructure in question is insufficient. If this results in too few relevant log events being recorded, security-critical incidents may remain undetected.