Our cloud based service is currently undergoing changes with a view towards PCI compliance.
It is a high throughput service, and there are concerns that enabling the right amount of logging on our web server application will hinder performance of our system (What logs to retain for PCI-DSS? - Retain All The Logs). During performance testing there is a large performance deficit when logging is enabled. This post suggests what should be logged from a PCI perspective.
Disregarding PCI, from a security point if view I believe we will need to log every HTTP request like the httpd web server does by default because if there is any breach it would be difficult to perform forensic analysis on a system if logs are missing.
Am I correct in believing we will need to log every request and we will just need to take the hit and scale appropriately? Would it be acceptable to log to RAM disk and export the logs at regular intervals as a possible PCI complaint solution to the performance problem?