Dear Webhost, Please enable Logging. Thank You.

Working with compromised accounts that have fell victim to the recent trend of Gumblar and Nine-Ball, I am noticing that there a lot of Web Hosting Companies that do not have logging enabled. They will either have RAW web access logs enabled for one day worth of retention (absolutely useless) , or none at all. So with that being said.

Webhosts, Please enable logging.
Please allow logging retention of at least 1 year.
Please enable FTP logging.

PCI DSS Requirement 10.7 asks that you retain audit trail history for at least one year, with a minimum of three months immediately available for analysis. The entire portion of Section 10 in the requirements are devoted to audit trail and storage of log files. This is a very crucial entity to analysis of the webserver. If you are not retaining log files, then you are not running a PCI complaint hosting environment, Bottom Line.