For all Logs from WHMCS (Activity Logs, Admin Logs, Module Logs etc.) there should be an option to send it to an Graylog instance.
We want to have an longterm archive, but do not want to fill up the database with these Data. So we will send all Logs to Graylog and delete all Logs older than 90 days in WHMCS to reduce the Amount of database storage needed.
The other point is, we want this for compliance too. If any one hacked our WHMCS or any Employee should do something dumb, then we are able to check all the logs to get more information about this case. Normally the Graylog Server is more secure than WHMCS (for example internal Network, only SSH Keys allowed, other login credentials etc.).