What is the difference between a log entry and an event?¶
An event is the activity or condition recognised by a system. A log entry is the recorded representation of that event.
Avoid this assumption: That the event and the log entry are the same thing. They are related, but the record may be incomplete, reformatted, delayed or generated at a different stage from the underlying activity. For example, a user may submit login credentials. The authentication service may treat that as an event. It may then create a log entry showing the account, time, source address and result. A separate identity platform, security tool and central logging system may each create additional entries for the same activity.
One event can therefore produce several log entries. These may record different stages, such as request received, authentication completed, token issued and session created. They may also show different timestamps because each system uses its own clock and records a different part of the process.
The reverse can also happen. A single log entry may summarise several events, such as repeated failed logins or multiple actions grouped into one transaction or alert record.
A log entry may contain the system’s interpretation rather than a direct description of the underlying event. Fields may be translated, normalised or enriched after collection. A dashboard might display a friendly label that does not appear in the original source record.
Investigators should identify whether they are examining the source log entry, a normalised version, an export or an alert built from several records. Request event definitions, field meanings and surrounding entries. Correlation identifiers, session IDs, request IDs and event codes may help link records across systems.
Do not assume that duplicate entries prove duplicate actions, or that one entry represents one human action. Where timing or sequence matters, compare records from all relevant systems.
Operational takeaway¶
Separate the activity that occurred from the record created about it, and establish how many systems recorded which part of the event.