A request might generate log entries a, b1, c or a, b2, c, depending on some conditions. The exact contents vary by request (otherwise there would be no need to log them), but the type is always the same.
If you find logs for c without either b1/b2 or a, you know log entries went missing.
If you have a 20% miss rate with recording your log entries, and you analyze just 20 log entries, the chance that one of them is missing is already around 98.8%.
If you actually use your logs for anything, it becomes pretty obvious pretty quickly when they are incomplete.
A request might generate log entries a, b1, c or a, b2, c, depending on some conditions. The exact contents vary by request (otherwise there would be no need to log them), but the type is always the same.
If you find logs for c without either b1/b2 or a, you know log entries went missing.
If you have a 20% miss rate with recording your log entries, and you analyze just 20 log entries, the chance that one of them is missing is already around 98.8%.
If you actually use your logs for anything, it becomes pretty obvious pretty quickly when they are incomplete.