The events can be generated by system daemons, applications, or other services running on it. To keep a track of the functionality, errors, performance and security, it is important to capture events and analyze them to find the cause of failure and/or intrusion. Logging is done for:
Accountability: On any system there are multiple users and what they do must be tracked, and if needed, the events should be linked to user accounts for accountability.
Intrusion detection: Any unusual or unauthorized activity can be traced using logs. Unusual login attempts, access from suspicious IPs, modification of system binaries, installation of backdoors, and so on can be tracked using logs.
Problem detection: Application failures and resource constraints, such as out of memory errors, write events into logs, which can help in narrowing down the issue.
The logs provide a proactive approach in terms of finding any security holes and help in plugging them on time. By collecting...
