Monitoring Computing Resources + Log Files

System monitoring

is typically done via system logs as well as through central management tools, including those found in cloud services

Application monitoring

may involve application logs, application management interfaces, and performance monitoring tests

Infrastructure devices

can also generate logs

Firewall logs

which can provide information about blocked and allowed traffic, and with more advanced firewalls like NGFW or UTM, devices can also provide application-layer details or IDS/IPS functionality along with other security service-related log information

Application logs

for Windows include information like installer information for applications, errors generated by applications, license checks, and any other logs that applications generate and send to application logs

Endpoint logs

such as application installation logs, system and service logs, and any other logs available from endpoint systems and devices

OS-specific security logs

for Windows Systems store information about failed and successful logins, as well as other authentication log information. Authentication and security logs for Linux systems are stored in /var/log/authlog and /var/log/secure

IDS/IPS logs

provide insight into attack traffic that was detected or in the case of IPS, blocked

Network logs

can include logs for routers and switches with configuration changes, traffic information, network flows, and data captured by packet analyzers like wireshark