In practice, at the scale I work at, it's barely feasible to scan one week of logs, let alone two months, because you'll be waiting hours for the result. So you learn strategies to only need to scan a subset of the logs at a time.