Access records and log management

What an access record shows

Web access logs record server requests according to logging settings, while system logs record authentication, account and privilege events; coverage depends on source settings. A web-server entry may show client IP, resource, HTTP status and user agent; an application log may record API requests, data queries and activity within a session. In some Linux distributions, /var/log/secure is an example location for system events. Windows Event Viewer displays Windows event records; it is not a web-access file. AWS S3, Azure Storage and Google Cloud can log resource access when configured. Error logs contain diagnostic messages about failures and problems. Audit logs help identify actions, changes and responsible accounts, and may overlap with access records.

Fields and a sample record

An entry can include date and time, IP address, HTTP method (GET, POST, PUT or DELETE), requested URL, status code, referrer URL, user agent and response-body bytes. In the Apache Combined Log example below, GET /dashboard received HTTP 200 and a 3456-byte response body; +0000 is the UTC offset. The two hyphens do not identify an authenticated user. The client IP may be a proxy, and HTTP 200 does not prove successful authentication. Referrer and user agent are supplied by the client, so compare them with other evidence.

      203.0.113.45 - - [06/Aug/2025:09:21:15 +0000] "GET /dashboard HTTP/1.1" 200 3456 "https://example.com/login" "Mozilla/5.0"
    

Locations and routine review

Check the configured location first; common Linux path examples are /var/log/apache2/access.log for Apache and /var/log/nginx/access.log for Nginx; IIS uses %SystemDrive%\inetpub\logs\LogFiles\W3SVC1. On Linux, tail -f /var/log/nginx/access.log can follow new entries. Windows Event Viewer displays system events; a file manager can open text access-log files. Control panels such as cPanel and Plesk and cloud consoles such as AWS CloudWatch and Azure Monitor are other ways to view logs. Examples for searching and analysis include grep, awk and less, log platforms such as Splunk, Graylog and ELK Stack, and cloud tools such as AWS Athena and GCP BigQuery. AWS S3 access logging requires setup, and delivery is best-effort: a missing record does not prove no request occurred. Windows UAL tracks feature and service access.

Format choice and an Apache configuration example

The configuration below uses Common Log Format (CLF); the Combined Log example above also includes referrer and user agent. If GeoIP or session linkage is needed for investigation, add only necessary fields and use a protected correlation identifier, not a raw session token. Exclude passwords and access tokens, and minimize other sensitive values. The directives set the format and log location; check them against the Apache version, modules and virtual-host configuration.

      LogFormat "%h %l %u %t \"%r\" %>s %b" common
CustomLog /var/log/apache2/access.log common
    

The log-management lifecycle

First aggregate the needed logs and parse their fields; normalization makes different formats, severity levels and error messages comparable. Then analyze records through search and rules, and set rotation and retention for their purpose. Hosted Logging as a Service can run part of this lifecycle, while the organization still defines sources and access.

1. 01

   Define the questions

   Start by asking what happened, when and where it happened, and who was involved.

2. 02

   Collect, parse and normalize

   Agents, collectors or API connections can forward records centrally, continuously or in batches. Parse time, IP, user and error-code fields, then normalize different formats for comparison.

3. 03

   Store and analyze

   Account for volume with compression and indexing, and analyze through queries, filters, search and visualization.

4. 04

   Manage alerts and access

   Set condition-based alerts and reports. Assign who reads and searches records, who administers retention, and who handles alerts; grant access for those tasks.

Retention, rotation and protection

Log rotation helps control file size; logrotate is one Linux example. Archives can be compressed and moved to protected storage. Set retention according to the record’s purpose, investigation needs, privacy obligations and applicable legal requirements; one period does not suit every law or organization. Define secure disposal when retention ends. Encrypt logs in transit and at rest, restrict access by role, audit changes, and document regular review and deletion of records that are no longer needed.

Operational and security uses

Log analysis helps establish when and where a fault or incident occurred, which systems were affected and what sequence led to it. Trends in server load, database queries, response times and application errors can reveal performance bottlenecks and capacity needs. Security teams investigate repeated failed logins, unusual access patterns, unauthorized requests, data exfiltration and suspicious network connections. Records forwarded to a SIEM can be correlated with other sources. Logs support audit archives and internal reporting; auditors may review them alongside control procedures and other evidence.

Development, analytics and business uses

DevOps and software teams use logs to debug, test versions and validate deployments. Page views, login times and transaction flows can help explain product use and user behavior. Web access records can reveal popular landing pages and referral sources, as well as crawler problems and 404 errors. These signals can help assess campaign and content performance. A rule-based alert can flag high CPU use or a firewall-rule change; automation can connect those signals to a team workflow.

Logging physical measurements

A data logger can automatically record measurements such as temperature, humidity, shock or location over time through sensors or software. USB loggers store data locally and require manual retrieval; wireless and IoT loggers can send real-time data to cloud platforms and dashboards. A QR code can identify a shipment or device or link to its recorded data; sensors and loggers, including single-use units, measure conditions during pharmaceutical or food shipments. Passive loggers record until data is retrieved; active loggers continuously send a stream to a central platform. Cold-chain monitoring can track transit temperatures, storage humidity and shock exposure for vaccines, biologics and sensitive medicines.

Industry, supply chains and the environment

In logistics, including last-mile delivery, records can track shipment conditions, help reduce spoilage, improve customer visibility and support transport-standard compliance. Manufacturing teams use them to monitor equipment health, plan maintenance and reduce downtime. Research and environmental projects may record weather, temperature, rainfall, wind, pollution and agricultural conditions. These physical sensor records have different sources and purposes from IT security logs that capture authentication, file access, network activity and application transactions.

Formats, cloud and scale

Structured logs use defined fields and consistent formats, which makes machine analysis and cross-system correlation easier. Unstructured free-text records remain common, but extracting and comparing fields can be harder. A collection pipeline should handle the required source formats; verify that filtering and normalization preserve records and fields needed for investigations. Cloud storage can provide flexible capacity; edge processing can filter redundant records, compress data and prioritize anomalies. Some platforms use AI and machine learning for analysis and classification, such as seeking anomalies or insider-threat patterns and surfacing possible equipment or system failure trends. Effective logging supports evidence-based decisions, audit reporting, operational cost optimization and threat detection. When choosing sources, consider volume, cost, transfer delay and data quality.

Log management and SIEM have different jobs

Log management provides general collection, storage, search and reporting across devices, applications and services. Sources may connect through agents, APIs or scripts, use formats such as Syslog, and feed dashboards for performance, availability and capacity. SIEM focuses on security events: it normalizes sources and applies correlation rules, analytics and context to prioritize possible threats and generate alerts. Functions can overlap: some log platforms correlate events too. SIEM packages security-focused correlation, use cases and investigation, while log management also serves operational search; results depend on source coverage, configuration and rule quality. Select the functions needed rather than assuming both products are required.

Choosing tools, alert volume and use cases

Start by defining the questions to answer, available sources, supported formats and teams responsible for investigating results. Log management can suit operational search and reporting; SIEM can suit security correlation and alerting. A large volume of alerts without context can burden analysts, so tune thresholds, correlation rules and investigation workflows. Smaller organizations should account for licensing, data volume, cost, skills and the time needed for daily administration. Test dashboards, Slack notifications, JIRA integration or automation against your own sources during evaluation.

Frequently asked questions

Answers to common questions about access records.