I really think the difficulty comes from the number of logs that are coming in from the number of devices. The more devices you add the more logging events that are going to be there. As the devices become more powerful and smarter the more they are going to put out. I feel that the number of logs coming from a bigger company can become unwieldy. This has become sure a burden for shops of any size.
We have started to use Symantec MSS for log evaluation. They collect logs from us and evaluate them and contact us for any issues that arise. This is convenient for the IT shop, but not everything is being logged. It's a cost vs risk kind of idea.
