Logging and Log Management The Authoritative Guide to Understanding the Concepts Surrounding Logging and Log Management

It’s been 25 years since I first encountered syslog. I was a newly minted system administrator with a little cluster of Sun-2s surrounding a Sun-3, trying to debug a UUCP connection over the phone with a friend, who told me “check the log” and talked me through it. There was something that practically hypnotized me about watching the syslog; I saw in retrospect that it was the best way to see that my computer was actually doing something. Windowing systems first showed me their value when they allowed me to have a window open in the upper corner of my screen, with ”˜tail –f /usr/spool/messages’ running; I could watch the emails work, the USENET news flow, processes start and stop””I could see that my computer was actually doing something! It wasn’t until years later when I experienced my first security incident, that I discovered that logs were useful for looking at the past as well as function in the present. By then it was already far past the time where a system administrator could watch their logs in the corner of the screen. Nowadays it’d just be a blur.