I understand that most web servers and web apps do not keep the body of HTTP POST requests in their logs. The reason for this is I assume the potentially large size of the bodies and the possibly sensitive information that they could contain (passwords, credit card numbers...).

But in case a server gets compromised, the POST request bodies could contain valuable data that could help pinpoint the vulnerability that was used to compromise the server.

Are there any best practices for logging POST bodies or is it really just decided on a case by case basis?