Log

The classic Unix transport is syslog. RFC 5424 (2009) defines the modern message format: a PRI value computed as facility × 8 + severity, a version, an RFC 3339 timestamp, hostname, app-name, procid, msgid, optional structured data and the free-text message. Severities run from 0 (Emergency) to 7 (Debug), and facilities distinguish sources such as kernel, auth, daemon and local0-local7. Many devices still emit the older, loosely specified BSD format described in RFC 3164, which lacks a year and time zone in its timestamp, a frequent cause of parsing errors. Transport is UDP 514 by default, which is lossy and unauthenticated; TCP with octet counting (RFC 6587) and syslog over TLS (RFC 5425) are the reliable alternatives. On modern Linux, systemd-journald stores binary, indexed entries with trusted metadata fields such as _PID, _UID and _SYSTEMD_UNIT, usually forwarded to rsyslog or an agent. Windows uses the Event Log service with channels (Application, System, Security, and many Operational channels) and XML-structured events identified by provider and event ID.

Application logs have shifted from free text to structured logging, typically JSON with consistent field names, correlation IDs and trace context, so that events can be queried rather than grepped. OpenTelemetry defines a log data model alongside traces and metrics, which lets a log line be tied to the distributed trace that produced it. Pipelines usually collect with an agent (Fluent Bit, Vector, Elastic Agent, the OpenTelemetry Collector), parse and enrich, then ship to a store or SIEM; buffering and back-pressure decide whether logs are silently dropped when the destination is slow.

NIST SP 800-92 frames log management as generation, transmission, storage, analysis and disposal, and the practical failures map to those stages: no central collection, so an attacker who wipes one host erases the evidence; unsynchronised clocks that make timelines impossible to reconstruct; retention too short for incidents that are discovered months later; and no one reviewing or alerting on what is collected. OWASP lists security logging and alerting failures as A09 in the Top 10:2025.

Logs are also an attack surface. Writing unsanitised user input into logs enables log forging with injected newlines (CWE-117) and, where the logging library interprets content, much worse: Log4Shell (CVE-2021-44228, December 2021) turned a JNDI lookup in Log4j 2 message formatting into remote code execution simply by getting a crafted string logged. Logs routinely leak secrets and personal data such as tokens in URLs, passwords in failed-login fields and CPR numbers in request bodies, so redaction at the source, access control on the log store and a defined retention period are required, not optional, under GDPR. A log differs from a metric (aggregated numbers over time) and a trace (the causal path of one request), and an audit log is a stricter subset kept as evidence of security-relevant actions.