Why do event logs record both normal and abnormal activities? Select all that apply.

Group of answer choices

b) Normal activities are so rarely logged that they do not add enough overhead to justify removing them.

a) An activity may look normal when it occurs and abnormal when analyzed in context with other activities

c) Normal activities help track side effects of abnormal activities