When a Linux system is compromised, the logs should tell you what happened. In a lot of cases, they don't.

Source: Your Linux Logs Probably Arent Catching Attacks: 2026 Detection Gaps