Logs

Logs

Logs are records of activities, events and changes generated by computers,
applications, networks, databases, servers, security devices and other
technology systems.

In cybersecurity, logs are extremely important because they provide
evidence about what happened, when it happened, where it happened and,
in many cases, which account or system was involved.

Security monitoring depends heavily on useful and trustworthy logs.
Without appropriate logs, investigating suspicious activity can become
extremely difficult.

Learning Objectives

By the end of this lesson, you should be able to:

• Define a security log.
• Explain why logs are important in cybersecurity.
• Identify common types of logs.
• Understand the information commonly contained in logs.
• Explain log collection and centralization.
• Understand log analysis and correlation.
• Explain log retention and rotation.
• Identify information that should not be logged.
• Describe methods for protecting security logs.
• Explain how logs support incident response.

1. What Is a Log?

A log is a recorded description of an event or activity that occurred
within a system.

For example, a web server may create a log entry when a visitor requests
a webpage.

An authentication system may create a log entry when a user successfully
or unsuccessfully attempts to sign in.

A firewall may create a log entry when it allows or blocks network traffic.

Each of these records can become useful when security professionals need
to understand system activity.

2. Why Logs Matter in Cybersecurity

Logs provide visibility into activities that may otherwise be difficult
to observe.

They can help security teams:

• Detect suspicious activity.
• Investigate security incidents.
• Identify unauthorized access.
• Track account activity.
• Understand system changes.
• Investigate malware incidents.
• Identify attack patterns.
• Determine the timeline of an incident.
• Support forensic investigations.
• Verify whether security controls are working.

3. Logs and Security Monitoring

Security monitoring collects information from different systems and
analyzes it for unusual or suspicious activity.

Logs provide much of the raw information used by monitoring systems.

For example, suppose a user account experiences 100 failed login attempts
within a few minutes.

The authentication system records each failed attempt in its logs.
A monitoring system can analyze those records and generate a security
alert.

4. Common Types of Logs

Authentication Logs

Authentication logs record login and authentication activity.

They may contain:

• Username
• Timestamp
• Source IP address
• Login result
• Authentication method
• Device information

Authorization Logs

Authorization logs can record attempts to access resources or perform
actions that require specific permissions.

They may help identify unauthorized access attempts or privilege-related
problems.

Web Server Logs

Web servers commonly record HTTP requests.

Typical information may include:

• Request time
• IP address
• Requested URL
• HTTP method
• Status code
• User agent

Application Logs

Application logs record events generated by software applications.

They may include errors, warnings, authentication events, application
actions and security-related events.

Database Logs

Database systems can generate logs describing queries, authentication,
configuration changes, errors and other database activities.

Firewall Logs

Firewalls can record network traffic that they allow, block or otherwise
process.

Operating System Logs

Operating systems generate logs for system events, services, users,
authentication and errors.

Endpoint Security Logs

Endpoint security software can record malware detections, suspicious
processes, blocked activities and other security events.

5. What Information Should a Log Contain?

The exact structure depends on the system, but useful logs commonly
contain several important fields.

• Timestamp: When the event occurred.
• Source: Where the event originated.
• User: Which account was involved.
• Event: What happened.
• Result: Whether the operation succeeded or failed.
• Resource: What system or resource was affected.
• Source IP: Where the request originated when applicable.
• Request information: Relevant application or network details.

6. Timestamps

Accurate timestamps are extremely important during security investigations.

Investigators often need to reconstruct the order in which events occurred.
If systems use incorrect or inconsistent times, the resulting timeline
can become confusing or inaccurate.

Organizations should therefore synchronize important systems using reliable
time sources and use consistent time formats where possible.

7. Log Levels

Many applications organize log messages according to severity or importance.

Common levels include:

• Debug: Detailed information useful during development or troubleshooting.
• Info: General information about normal operations.
• Notice: Important but generally normal events.
• Warning: A condition that may require attention.
• Error: A problem that prevented an operation from completing correctly.
• Critical: A serious problem requiring immediate attention.
• Alert: A condition that may require urgent action.
• Emergency: A severe condition affecting system operation.

The exact levels vary between operating systems, applications and
logging frameworks.

8. Security Events in Logs

Security-relevant events should be logged when appropriate.

Examples include:

• Successful authentication.
• Failed authentication.
• Password changes.
• Account creation.
• Account deletion.
• Privilege changes.
• Administrative actions.
• Security configuration changes.
• Firewall rule changes.
• Access to sensitive resources.
• Malware detections.

9. Failed Login Monitoring

Repeated failed authentication attempts can indicate password guessing,
credential attacks or a misconfigured application.

For example, consider the following pattern:

10:01 - admin - login failed
10:01 - admin - login failed
10:02 - admin - login failed
10:02 - admin - login failed
10:03 - admin - login failed
10:03 - admin - login successful

This sequence may deserve investigation, particularly if the successful
login occurs from an unusual location or device.

10. Web Server Logs

Web server logs can provide valuable information during web application
security investigations.

A web server log may reveal:

• Repeated requests from one IP address.
• Requests for unusual URLs.
• Repeated HTTP errors.
• Requests for administrative pages.
• Unexpected HTTP methods.
• Suspicious user agents.
• Abnormal request patterns.

Web server logs should be analyzed carefully because normal users and
automated services can also generate unusual-looking traffic.

11. Application Logs

Applications should record security-relevant activities without exposing
sensitive secrets.

Useful application events may include:

• Authentication failures.
• Authorization failures.
• Password changes.
• Account changes.
• Administrative actions.
• Important configuration changes.
• Security-related errors.

12. What Should Not Be Logged?

Logging too much information can create a security problem.
Sensitive information should not be placed in logs unnecessarily.

Never casually log:

• Plaintext passwords.
• Authentication tokens.
• Session secrets.
• API keys.
• Private encryption keys.
• Credit card information.
• Other highly sensitive credentials.

Security logs should contain enough information to investigate events
without becoming a source of additional security exposure.

13. Centralized Logging

Centralized logging means collecting logs from multiple systems into a
central location.

For example, an organization may collect information from:

• Web servers
• Application servers
• Databases
• Firewalls
• Endpoints
• Cloud services
• Authentication systems

Centralization makes it easier to search, correlate and analyze events
across the environment.

14. Log Correlation

Log correlation involves examining events from different sources to
identify relationships and patterns.

For example:

1. A firewall records suspicious traffic.
2. A web server records unusual requests.
3. An application records authentication failures.
4. An endpoint records a suspicious process.

When these events occur close together, security analysts may determine
that they are related.

15. Log Analysis

Log analysis is the process of examining logs to identify useful
information, errors, suspicious behavior and security threats.

Analysis can be performed manually for small environments or with
automated tools for large environments.

Analysts may search for:

• Repeated failures.
• Unexpected access.
• Known indicators of compromise.
• Unusual IP addresses.
• Unexpected administrative actions.
• Abnormal request patterns.
• Changes to critical systems.

16. Security Information and Event Management

Security Information and Event Management, commonly known as SIEM,
provides centralized collection and analysis of security information.

A SIEM platform can:

• Collect logs from many systems.
• Search large quantities of events.
• Correlate related events.
• Generate alerts.
• Support investigations.
• Provide dashboards.
• Support security reporting.

17. Log Retention

Log retention is the practice of keeping logs for a defined period.

Retention requirements depend on factors such as:

• Security needs
• Business requirements
• Storage capacity
• Regulatory requirements
• Incident investigation requirements

Logs should not necessarily be stored forever. Organizations should
define appropriate retention periods and securely dispose of records
when they are no longer required.

18. Log Rotation

Log rotation is the process of managing old log files so that storage
does not become exhausted.

A rotation strategy may involve:

• Creating new log files periodically.
• Compressing older logs.
• Moving logs to long-term storage.
• Deleting logs after the approved retention period.

19. Protecting Logs

Logs may contain valuable security evidence and should therefore be
protected against unauthorized access, alteration and deletion.

Useful controls include:

• Access control.
• Authentication.
• Encryption in transit.
• Protected storage.
• Centralized collection.
• Integrity monitoring.
• Restricted administrative access.
• Appropriate retention policies.

20. Log Injection

Log injection occurs when untrusted input is inserted into logs in a way
that can manipulate their interpretation or structure.

Applications should sanitize and structure log data appropriately.
Structured logging can make it easier to distinguish data fields from
log messages.

21. Structured Logging

Structured logging stores event information in a consistent format such
as JSON.

For example:

{
  "event": "login_failure",
  "username": "admin",
  "timestamp": "2026-10-05T12:30:00Z",
  "source": "web_application",
  "result": "failed"
}

Structured logs are easier for automated systems to parse, search and
correlate.

22. Logs and Incident Response

Logs are extremely useful during incident response.

When an incident occurs, investigators may use logs to determine:

• When the activity began.
• Which systems were affected.
• Which accounts were involved.
• What actions occurred.
• How the attacker entered the environment.
• Which resources were accessed.
• Whether the attacker moved between systems.
• What actions should be taken next.

23. Example Incident Investigation

Imagine that a company’s administrator account is suspected of being
compromised.

Investigators may examine:

1. Authentication logs.
2. VPN logs.
3. Firewall logs.
4. Web server logs.
5. Application logs.
6. Endpoint security logs.
7. Administrative activity logs.

By combining these records, investigators can build a timeline of the
incident.

24. Log Access Control

Not every employee should have unrestricted access to security logs.

Access should be based on job responsibilities.

For example:

• Security analysts may need read access.
• Security administrators may need management access.
• Developers may need limited application-log access.
• General users normally should not have access to security logs.

25. Monitoring Log Integrity

Attackers may attempt to delete or modify logs to hide their activities.

Organizations should therefore consider controls that make unauthorized
modification difficult to perform or easy to detect.

Examples include centralized log collection, restricted permissions,
integrity monitoring and protected storage.

26. Logs in WordPress

WordPress websites can generate several types of useful security
information through WordPress itself, plugins, hosting infrastructure
and web server logs.

Administrators may need to investigate:

• Failed administrator logins.
• Successful administrator logins.
• Plugin changes.
• Theme changes.
• User creation.
• Permission changes.
• Unexpected file changes.
• Web server requests.

A WordPress security monitoring strategy should avoid exposing passwords,
authentication cookies, API keys or other sensitive credentials in logs.

27. Simple PHP Logging Example

The following example demonstrates how an application can record a
security event without logging a password.

<?php

$event = array(
    'event'     => 'authentication_failure',
    'username'  => $username,
    'timestamp' => gmdate( 'c' ),
);

error_log(
    wp_json_encode( $event )
);

The example records the event type, account and time, but does not record
the user’s password.

28. Good Logging Practices

• Log important security events.
• Use accurate timestamps.
• Use consistent formats.
• Protect logs from unauthorized access.
• Protect logs from unauthorized modification.
• Avoid logging secrets.
• Centralize important logs where appropriate.
• Define retention periods.
• Review logs regularly.
• Test log collection.
• Monitor the logging infrastructure itself.

29. Common Logging Mistakes

• Not logging important security events.
• Logging passwords or access tokens.
• Keeping logs indefinitely without a policy.
• Deleting logs immediately after an incident.
• Allowing everyone to access security logs.
• Using inaccurate timestamps.
• Ignoring application logs.
• Failing to centralize important records.
• Collecting huge amounts of information without analyzing it.

30. Practical Lab

Design a basic logging plan for a small web application.

Your plan should identify:

1. Five security events that should be logged.
2. Three types of logs that should be collected.
3. Three pieces of information each log should contain.
4. Three types of information that must not be logged.
5. Who should have access to the logs.
6. How long the logs should be retained.
7. How logs should be protected from unauthorized modification.

31. Knowledge Check

1. What is a log?
2. Why are logs important in cybersecurity?
3. Name five different types of logs.
4. What information can an authentication log contain?
5. Why are accurate timestamps important?
6. What is centralized logging?
7. What is log correlation?
8. What is log retention?
9. Why should passwords not be written to logs?
10. How do logs help during incident response?

32. Key Terms

• Log: A recorded event or activity generated by a system.
• Log Analysis: Examination of logs to identify useful or suspicious activity.
• Log Retention: Keeping logs for a defined period.
• Log Rotation: Managing log files as they grow over time.
• Centralized Logging: Collecting logs from multiple systems in a central location.
• Correlation: Connecting related events from different sources.
• SIEM: Security Information and Event Management.
• Structured Logging: Recording events in a consistent machine-readable format.
• Log Injection: Manipulation of log data through unsafe handling of untrusted input.

33. Summary

Logs are one of the most valuable sources of security information in a
technology environment.

They provide records of authentication, application activity, network
traffic, system events, administrative actions and other important
activities.

Effective logging requires more than simply creating log files. Logs must
be useful, accurate, protected, retained appropriately and regularly
analyzed.

Organizations should also avoid recording passwords, authentication
tokens, private keys and other sensitive secrets in logs.

When properly implemented, logs provide critical evidence for security
monitoring, threat detection and incident response.

Next Lesson

In the next lesson, we will study
Security Alerts and learn how security systems identify,
prioritize and communicate potentially dangerous events.