Collecting logs nobody reads isn't security. It's storage.
Most environments log a lot. Every device and every login gets written down and shipped to a platform that charges by the gigabyte, and the compliance box gets ticked.
Then something happens, and the evidence was in the logs all along. Nobody was looking, or the alert went to a channel nobody watches, along with hundreds of others.
Logging is the easy half. Monitoring is the work: deciding what matters and tuning out the rest, with someone ready to respond when an alert fires.
So the useful question isn't how much you log. It's what you would notice, and how fast, while it was still happening.