Ability to quickly extract information when required (forensic). The ease at which you can integrate your devices which are logging(agnostic) . Ability of the device to capture all your required logging and maintain it for a reasonable time frame (capacity).
