None
Keeping logs that normally would be discarded, because they contain records of activity of particular interest.
Source(s):
NIST SP 800-92