infrastructure events • Purpose: troubleshooting of the system, health monitoring • Content: audit messages, metrics, low-level events Business logs • Focus: business logics and flows • Purpose: Track high level user actions and flow, troubleshoot high-level flows • Content: user activities, transaction, etc Most probably you need both!