Should high-traffic services sample logs

A service at thousands of requests per second writes two info lines each: hundreds of millions of lines a day. Neither the disk nor grep keeps up.

The rule: keep all errors, sample the normal path.

if (level >= WARN || rand() % 100 == 0) { log(...) }

Random sampling breaks correlation, though — lines from one request may be split. Hashing request_id keeps a request either fully logged or not at all, and time-window sampling switches whole seconds on and off.

Another common requirement is keeping slow requests:

if (duration > 500ms || level >= WARN) { log(...) }

That beats uniform sampling; what you want during an incident is the abnormal sample, not a random one.