An intrusion discovered today may have started months ago. The NCSC tells you to size the log window to that gap, initial access to detection: 13 months for critical systems, 180 days otherwise. Rotate at 30 days and you can only reconstruct the last month.
How fast logs leave the box matters as much. Logs left on the box belong to whoever owns the box. Move them to a central store quickly and the attacker loses the chance to delete their own tracks.
Logging Made Easy, the NCSC's open source project, is built on something beats nothing. Their phrase is flight recorder.
https://www.ncsc.gov.uk/blog-post/what-exactly-should-we-be-logging
National Cyber Security CentreWhat exactly should we be logging?A structured look at what data to collect for security purposes and when to collect it.