Within an information domain, there are often IT systems and applications with default settings in which logging has not been enabled. Sometimes, individual IT systems or applications are not able to perform logging at all. In both cases, important information may be lost and it may be impossible to detect attacks in time. This is also possible if logging is used for individual IT systems or applications, but the log data is not collected in a central location. In information domains without centralised logging, it is difficult to ensure that the relevant logged information from all IT systems and applications will be preserved and analysed.

Furthermore, log data must contain meaningful information. The events to be logged depend, among other things, on the protection needs of the corresponding IT systems or applications. If this is disregarded—for example, by only using the default settings of IT systems and applications for logging—it may result in particularly relevant security events not being logged. Attacks may then go undetected.