Table of Contents

Log management

Return to Logging topics

Log management (LM) comprises an approach to dealing with large volumes of computer-generated data logging | log messages (also known as audit records, audit trails, event-logs, etc.).

Log management generally covers:<ref>

</ref>

Overview

The primary drivers for log management implementations are concerns about computer security | security,<ref>

</ref> system and network operations (such as System administrator | system or Network administrator | network administration) and regulatory compliance. Logs are generated by nearly every computing device, and can often be directed to different locations both on a local file system or remote system.

Effectively analyzing large volumes of diverse logs can pose many challenges, such as:

Users and potential users of log management may purchase complete commercial tools or build their own log-management and intelligence tools, assembling the functionality from various open-source model | open-source components, or acquire (sub-)systems from commercial vendors. Log management is a complicated process and organizations often make mistakes while approaching it.<ref>

</ref>

Logging can produce technical information usable for the maintenance of applications or websites. It can serve:

Terminology

Suggestions were made

to change the definition of logging. This change would keep matters both more pure and more easily maintainable:

Deployment life-cycle

One view

of assessing the maturity of an organization in terms of the deployment of log-management tools might use

successive levels such as:

  1. in the initial stages, organizations use different log-analyzers for analyzing the logs in the devices on the security-perimeter. They aim to identify the patterns of attack on the perimeter infrastructure of the organization.
  2. with increased use of integrated computing, organizations mandate logs to identify the access and usage of confidential data within the security-perimeter.
  3. at the next level of maturity, the log analyzer can track and monitor the performance and availability of systems at the level of the Business | enterprise — especially of those information-assets whose availability organizations regard as vital.
  4. organizations integrate the logs of various business-applications into an enterprise log manager for better value proposition.
  5. organizations merge the physical-access monitoring and the logical-access monitoring into a single view.

See also

References