Exactly. The audit failure you describe shifts the conversation from ROI to pure risk. Management can debate "efficiency gains," but they can't ignore a quantifiable security finding.
We saw something similar, though the trigger was PCI-DSS. A simple rule change in our old system required three separate changes across modules, each with its own, non-correlated audit log. The auditor couldn't verify the change was atomic and secure. The finding wasn't about the tool's uptime, it was about its *verifiability*.
That's the real cost: when the complexity of the tool directly creates compliance gaps. It forces you to choose between operational security and the vendor's prescribed workflow. Switching after that isn't a preference; it's a remediation plan.
Buy once, cry once.
Verifiability is the only metric that matters when the auditors show up. They don't care about your dashboards.
But let's not kid ourselves, a simpler tool doesn't magically fix this. You're just trading one set of problems for another. Now your audit trail is in one place, great. What happens when that "simpler" vendor gets acquired and the new owners scrap the coherent logging system for their own fragmented mess? Seen it happen.
The real remediation plan is owning the logs yourself, feeding everything into your own SIEM. You can't outsource your compliance.
If it ain't broke, don't 'upgrade' it.
You're not wrong, but you've skipped over the practical reality of running your own SIEM. Ownership has a massive TCO that the "simpler tool" argument often ignores. The cost isn't just licensing, it's the staffing and institutional knowledge required to build and maintain those pipelines, ensure the schemas remain sane, and keep the queries performant. For teams already strained, that's not a trade, it's another cliff.
I've seen the acquisition play out too. The difference is, when a focused tool gets gutted, migrating is painful but contained. When your foundational, self-hosted log infrastructure depends on an OSS project that gets acqui-hired or a vendor that pivots, your "ownership" evaporates overnight and you're rebuilding your entire observability spine.
The goal isn't to outsource compliance, it's to reduce the moving parts that can fail compliance for you. A simpler tool with a clean export to your own cold storage often strikes the right balance between vendor risk and operational burden.
latency is a liar
You've hit on the real hidden cost, but I think you're overstating the staffing burden. A basic Loki or Elastic stack doesn't require a full time team to run for most small to mid sized shops. The institutional knowledge you're talking about is spent anyway, but now it's spent learning the vendor's proprietary query language and fighting their black box.
The "clean export to cold storage" is a fantasy nine times out of ten. The export is either crippled, costs extra, or lags so far behind it's useless for a real-time audit requirement. You're still at their mercy.
If you're already strained, managing a simple, dumb log bucket you control is less mental overhead than managing a vendor relationship with a "simple" front end.
-- bb