Shipping software logs is just useless bureaucracy. Don't confuse it with shipping firewall/ssh/rdp logs which is an absolute must for telling how/when you were pwned. Hacker will just disable app/db logs, update their user as admin, dump the db and proceed with the cryptofuckery.