What is a log?¶
A log is a record created by a system, application, device or service about activity it has been configured to record.
Avoid this assumption: That a log is a complete and neutral history of everything that happened. It is not. A log only records what the system was capable of seeing, what logging was enabled to capture and what was retained. A log may contain individual entries about authentication, network connections, file access, administrative changes, errors, transactions, security detections or automated processes. Each entry will normally include some combination of a timestamp, event type, status, account identifier, device identifier, network address, process name or reference number.
The exact meaning depends on the system that created it. Two products may use the same field name differently. A field labelled “user” might mean the account involved, the account that initiated a request, the account under which a service was running or the identity supplied by another system.
A log may be stored locally, forwarded to a central collector, displayed in a dashboard or exported into a spreadsheet or text file. During that process, records may be filtered, normalised, enriched, delayed or reformatted.
A log entry may support that a system recorded a particular event. It may help establish timing, sequence, account use, device activity or communication between services. It does not automatically prove who was physically present, who intended the action or whether the recorded account was being used legitimately.
Investigators should preserve the original source where possible, request field definitions and establish the time zone, retention period and logging configuration. Relevant entries before and after the event may be as important as the entry first identified.
Where the log is central to attribution or appears incomplete, seek assistance from the system owner or an appropriate specialist.
Operational takeaway¶
Treat a log as a system’s configured record of activity, not as a complete history or automatic proof of human responsibility.