- [Instructor] Logging goes hand in hand with monitoring.
Monitoring your network can be done in real time
or after the fact.
Logging is necessary for after the fact monitoring.
It establishes an audit trail, which is often mandated.
There are many sources of logs.
For example, all the hosts in your network generate logs.
The host here refer to computers, routers, firewalls,
IDSs, IPSs, servers, et cetera.
Any devices connected to your network
can generate these log messages.
Therefore, there are overwhelming sources of logging,
which creates a need for forwarding the logs
to a centralized log server
where you can monitor all the logs simultaneously.
As you can see here,
a centralized log server collects all these log messages
from individual hosts in your network.
Logging is important,
but if nobody analyzes the logs, it's good for nothing.
This is why logging is usually combined
with a feature such as alerts,
automatically generated and sent to relevant people
via emails and text messages.