What is logging and log management?

Logging: definition and meaning

Every piece of software, every server and every network component can write events to log files, so-called logs: who accessed which page and when, which error occurred, who logged in or changed a setting. Logs are a system’s memory and often the only source for understanding afterward what happened.

Entries usually have a timestamp, a severity (log level such as info, warning or error) and a description. More advanced systems write structured logs, for example as JSON, so entries can be filtered, searched and analyzed by machine instead of being read laboriously by hand.

Log management: from file to central analysis

With several servers or services, reading logs one by one on each machine is impractical. Log management therefore collects them centrally, stores them for a defined period and offers search, filters, analyses and alerts. Common solutions include the Elastic Stack, Graylog or Grafana Loki, as well as services from cloud providers.

Centrally collected logs have a further advantage: they survive the failure of a server and can be better protected against later alteration by an attacker. Access protection, retention periods and a deletion policy therefore belong in the concept, because logs often contain personal data such as IP addresses or user names.

Real-world example: a property management company’s customer portal

Tenants of a property management company report that the customer portal occasionally will not open and that login sometimes leads nowhere. The error occurs irregularly and cannot be reproduced. Without logs, troubleshooting would be guesswork, and the operator could give tenants only vague answers. So it analyzes the centrally collected logs.

The central logs show that every morning at the same time a maintenance script briefly blocks the database; logins then run into a timeout. The operator reschedules the job. In the same logs, numerous failed login attempts from a few addresses also stand out, and these are stopped with a block.

Benefits, limits and data protection

Logs speed up troubleshooting, document processes and are the most important trace in security incidents. Too much logging, however, burdens storage and performance, while too little leaves gaps. Data protection calls for particular care: passwords and sensitive content do not belong in logs, and short, justified retention periods should apply to IP addresses and user data.

Nano Concepts sets up logging so that it remains useful for operations and security: structured logs, central analysis, sensible retention periods and alerts for unusual patterns—aligned with your data protection requirements and the guidance of your data protection officer, so that logs help in an emergency and do not become a risk themselves.

• Timestamp, log level and a unique request ID in every entry
• Never log passwords, tokens or sensitive content
• Collect logs centrally and protect them against later alteration
• Define the retention period and delete automatically
• Pair unusual patterns such as many failed logins with alerts