There's always another log that could have been key to getting to the bottom of an incident. It's impossible to know completely what will be useful in advance.