Logs and monitoring

The record and the watch

Two related habits help you notice when something goes wrong: keeping logs, and doing monitoring. A log is a record of what happened. Monitoring is paying attention to those records and to live activity, watching for anything unusual. One writes things down; the other keeps an eye out.

Logs: what happened, and when

A log is an automatic diary that systems keep as they run. Each entry is a small note: this account signed in at this time, this file was opened, this setting was changed, this login attempt failed. On its own each line is dull. Together they become the record you turn to when you need to understand an event.

After anything suspicious, logs answer the important questions. When did it start? Which account was involved? What did it touch? Without logs you are guessing. With them, you can reconstruct what actually happened and how far it went. That is also why attackers sometimes try to delete or alter logs: the record is inconvenient for them.

Monitoring: noticing the unusual

Logs are only useful if someone, or something, actually looks at them. Monitoring is that looking. Instead of a person reading millions of lines, systems watch for patterns that suggest trouble and raise an alert.

• A login from a new country minutes after one at home.
• A single account failing its password fifty times in a row.
• A quiet file suddenly being copied in bulk at 2am.

None of these proves an attack by itself, but each is worth a look. Good monitoring turns a flood of raw records into a short list of "this is odd, check it", so problems get caught in hours rather than months.

How they support integrity

Logs and monitoring do more than catch intruders. They help protect integrity: the assurance that data and systems are accurate and have not been changed without permission. If a record is altered, a reliable log shows who changed what and when, so you can tell the trustworthy from the tampered. Monitoring flags unexpected changes as they happen, rather than long after.

For most people the practical takeaway is simple: logs and alerts are not spying, they are how problems get noticed while they are still small. If you ever run a system, keeping logs and glancing at the alerts is one of the cheapest ways to catch trouble early.