Log management

This article has multiple issues. Please help improve it or discuss these issues on the talk page. (Learn how and when to remove these template messages) The neutrality of this article is disputed. Relevant discussion may be found on the talk page. Please do not remove this message until conditions to do so are met. (May 2015) (Learn how and when to remove this message) This article needs additional citations for verification. Please help improve this article by adding citations to reliable sources. Unsourced material may be challenged and removed. Find sources: "Log management" – news · newspapers · books · scholar · JSTOR (May 2018) (Learn how and when to remove this message) (Learn how and when to remove this message)

Log management is the process for generating, transmitting, storing, accessing, and disposing of log data. A log data (or logs) is composed of entries (records), and each entry contains information related to a specific event that occur within an organization’s computing assets, including physical and virtual platforms, networks, services, and cloud environments.^[1]

The process of log management generally breaks down into:^[2]

• Log collection - a process of capturing actual data from log files, application standard output stream (stdout), network socket and other sources.
• Logs aggregation (centralization) - a process of putting all the log data together in a single place for the sake of further analysis or/and retention.
• Log storage and retention - a process of handling large volumes of log data according to corporate or regulatory policies (compliance).
• Log analysis - a process that helps operations and security team to handle system performance issues and security incidents