That's my question as well. What level of logging is acceptable?

1. httpd access logs and mail syslog messages
2. Source addresses to destination 80/tcp and 25/tcp
3. IP headers that hit a mail or web server
4. Full packet captures for all daemons
5. Full packet captures of all traffic

This is not very well thought out. There are so many ways to proxy, encapsulate and encrypt traffic, logs would be useless.

In San Francisco, 75k is not a very comfortable salary.