Many ask for best practices when it comes to monitoring logs. Here are a few things to be aware of:

Logs Centrally Stored

Use a system that collects and stores server logs in a central location. The system can be queried in an ad hoc fashion by authorized users.

Logs Retained for 12 Months

Utilize logging software that retains logs for at least 12 months.

When speaking with your audit firm, you can also confirm this is something they test for.

Here's a specific request one of our audit firm partners tests for against AWS:

​Inspected AWS CloudWatch logs to determine that CloudWatch was configured to monitor web traffic and suspicious activity.

It's also important to have intrusion detection systems like AWS Guard Duty running, which will be looking at the logs and will sending warnings for any issues found.