Dictionary · Defensive Security
Log Analysis
Operations · Beginner
Examining records of system and application activity to explain what happened, often by correlating time, identity, and result.
Logs answer who, when, and what result. Accurate clocks and consistent identities make the story readable. Without them, the files are a pile of timestamps.
Example: An analyst filters a web log for one account and sees a normal morning of work followed by a download of every customer record.
Common misconception
- A log line is evidence of what the system recorded, which may be incomplete if logging was off or the clock was wrong.