Logging captures discrete events across network infrastructure—from firewalls and endpoints to SIEM systems—giving security teams a record of what happened, when, and where. Centralizing those logs through aggregation servers, synchronized timestamps via NTP, and syslog protocols turns raw data into a coherent, investigable timeline.
Network Logging
One of the ways we can collect information on what's happening within our infrastructure is something called logging. Logging allows us to see events that are happening on our network infrastructure.
The word logging just means recording events. Something happens, and then it creates a log. Let's just take a look at an example of logging. Let's say we have an application here with a server, and somebody gains admin access to the server, and we want to know when anybody has admin access to the server. What happens is we log an event. That's not something that is just like a stat, like a percentage — it is something that happened. So we can log events.
There is some overlap between logging and polling. We could be polling the CPU usage right here, and what happens is the CPU is going to go up and down, and maybe at some point in time it goes above 80%, and that's our magic marker right there. That's the point in time we want to be notified that we have high CPU usage. If we're polling this, then whatever system is polling this information can notify us when it goes above that. But logging is the idea that this is an event that has happened as well, so now we're going to log this as an event on the server.
Where is it that logging happens? It really happens on any of our equipment that's out there. These different systems are doing logging all the time:
So we could be doing logging in a lot of different areas here.
On each one of those devices there are different levels of logging. We can choose a low level of logging, which means that it will log any low-level events and anything above that, which ends up being a lot of logging. Or we could do something that has a very high setting, where it will only notify us if it's something that's really serious, and then it won't notify you as often. There's a lot less with this — you have less visibility with this, but it also uses less resources. Taking all of these logs and logging everything ends up taking quite a bit more resources, whether it's processing power or the actual volume of logs that we have.
Since all of this equipment is logging, one of the problems that we run into is that if there is a security risk on our network, we now have to visit each one of these pieces of equipment and look at the logs to see what's happening. This could be problematic.
One thing we could do is set up a log management server. Then all of these logs could get reported back to this one location here, and then we have just one area that we need to check, one system that we need to check, to see what's happening across our network and infrastructure. We call this log ingestion.
What these systems also will do is log aggregation. It will take all of these logs and combine them into a more simple log, or do some altering of these logs to make sure it's consistent among them. But a lot of times we just generalize this and say that this is log aggregation, and this is a log aggregation server.
We do run into another issue with this. If we are aggregating all of these logs into one location here but the times are off — the timestamp is a part of these logs — then, since we're going to have all the logs together, if the timestamps are off it makes it really hard to see what's happened on the network. Let's say we're researching an attack that's happened and all of our timestamps are off, so things are in a different order. Now it's hard to establish what has happened on our network and what's compromised.
So what we need to do is make sure that all of the time is synchronized on all of our devices. Of course, if we do this manually that can get off over time, so the best way to do this is through Network Time Protocol. We establish a primary time server, and then all of these devices check in with that time server and all of the clocks on all these devices are then synchronized, and therefore the logs are synchronized.
The main way that we transfer these event logs is through a syslog server, or a syslog protocol. That's a way that we can transfer these different event logs from one location to another. Although I did throw in here email, and also text messages, as a couple of other ways that we send at least event information out — that would be more of a notification, so it doesn't quite fit this protocol level of shipping these events out.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →