IANAL nor close to it but is there any legal requirement in the US to keep logs avoid user activity besides access logs? I'd be surprised that the US federal law forces you to keep a full activity log so that they can take a look later for some reason.
Does it matter if it's a law? One day a national security letter from some three letter agency shows up at your doorstep, requiring you to keep logs (or let their engineer install a room 641A), and forbidding you from saying you do.
