What is a system log?¶

A system log is a record created by an operating system or by a core service that helps the device or server function.

For an investigator, the important point is not the label “system log”. It is what system produced the record, what activity it was capable of observing and why the entry was created.

Avoid this assumption: That a system log is a complete and neutral history of everything that happened on the device. It is not.

System logs may record events such as startup and shutdown, service failures, software installation, device connections, account activity, configuration changes, errors and security-related events. Different operating systems divide this material differently, and the same activity may appear in several logs or not be recorded at all.

A system log usually describes what the operating system or service observed. It may identify a process, account, device name, event code, status and timestamp. That can help establish that a machine was running, that a service started, that an account was used or that a fault occurred.

But the entry does not automatically identify the person responsible. Activity may have been caused by a user, administrator, application, scheduled task, remote session or automated service. A system log may also use the device’s own clock, which could be wrong or set to a different time zone.

Ask for the original source, the operating-system version, the log name, the event code and its field definitions. Preserve surrounding entries, because a single line often makes sense only when read with what happened before and after it. Check whether logging was enabled, whether records roll over and whether the export has altered or omitted fields.

Operational takeaway¶

A system log records what an operating system or core service observed, but its meaning depends on the source, configuration, surrounding events and attribution evidence.