Log management is the process for generating, transmitting, storing, accessing, and disposing of log data. A log data (or logs) is composed of entries (records), and each entry contains information related to a specific event that occur within an organization's computing assets, including physical and virtual platforms, networks, services, and cloud environments.
The process of log management generally breaks down into:
The primary drivers for log management implementations are concerns about security, system and network operations (such as system or network administration) and regulatory compliance. Logs are generated by nearly every computing device, and can often be directed to different locations both on a local file system or remote system.
Effectively analyzing large volumes of diverse logs can pose many challenges, such as:
Users and potential users of log management may purchase complete commercial tools or build their own log-management and intelligence tools, assembling the functionality from various open-source components, or acquire (sub-)systems from commercial vendors. Log management is a complicated process and organizations often make mistakes while approaching it.
Logging can produce technical information usable for the maintenance of applications or websites. It can serve:
Suggestions were made to change the definition of logging. This change would keep matters both purer and more easily maintainable:
One view of assessing the maturity of an organization in terms of the deployment of log-management tools might use successive levels such as:
Log management is a prerequisite for compliance with numerous regulatory frameworks that mandate audit trails and activity monitoring.
The Health Insurance Portability and Accountability Act (HIPAA) Security Rule requires covered entities to implement audit controlsâÂÂhardware, software, and procedural mechanisms that record and examine activity in information systems containing electronic protected health information (45 CFR 164.312(b)). It also requires regular review of information system activity records such as audit logs, access reports, and security incident tracking (45 CFR 164.308(a)(1)(ii)(D)). The December 2024 Notice of proposed rulemaking (NPRM) to modernize the HIPAA Security Rule would strengthen these requirements by mandating centralized collection and review of audit logs across all systems containing ePHI, with the ability to detect and alert on unauthorized activity.
The National Institute of Standards and Technology (NIST) SP 800-92, Guide to Computer Security Log Management, provides detailed guidance on establishing log management infrastructures, including log generation, transmission, storage, analysis, and disposal. The Payment Card Industry Data Security Standard (PCI DSS) requires tracking and monitoring of all access to network resources and cardholder data, with log retention of at least twelve months and a minimum of three months immediately available for analysis (Requirement 10).