Due to complex information domains and wide-ranging attack scenarios, the requirements logging systems need to meet are increasing because a very large amount of log data must be stored and processed. Moreover, it is customary to increase the intensity of logging when security incidents occur. However, if the corresponding logging infrastructure is not designed for this, the log data stored may be incomplete. As a result, security-relevant events will be assessed insufficiently (or not at all) and security incidents will remain undetected.