Don't log what you don't need. Full user-agents, IP addresses, raw request bodies — if you're not actively using it, don't keep it. Logs are a liability too.