2 cissp ® Official Study Guide Eighth Edition

Common Log Types 
There are many different types of logs. The following is a short list of common logs avail-
able within an IT environment. 
Security Logs
Security logs record access to resources such as fi les, folders, printers, and 
so on. For example, they can record when a user accessed, modifi ed, or deleted a fi le, as 
shown earlier in Figure 17.5 . Many systems automatically record access to key system fi les 
but require an administrator to enable auditing on other resources before logging access. 
For example, administrators might confi gure logging for proprietary data, but not for pub-
lic data posted on a website. 
System Logs
System logs record system events such as when a system starts or stops, or 
when services start or stop. If attackers are able to shut down a system and reboot it with a 
CD or USB fl ash drive, they can steal data from the system without any record of the data 
access. Similarly, if attackers are able to stop a service that is monitoring the system, they 
may be able to access the system without the logs recording their actions. Logs that detect 
when systems reboot, or when services stop, can help administrators discover potentially 
malicious activity. 
Application Logs
These logs record information for specifi c applications. Application 
developers choose what to record in the application logs. For example, a database developer 
can choose to record when anyone accesses specifi c data objects such as tables or views. 
Firewall Logs
Firewall logs can record events related to any traffi c that reaches a fi rewall. 
This includes traffi c that the fi rewall allows and traffi c that the fi rewall blocks. These logs 
commonly log key packet information such as source and destination IP addresses, and 
source and destination ports, but not the actual contents of the packets. 
Proxy Logs
Proxy servers improve internet access performance for users and can control 
what websites users can visit. Proxy logs include the ability to record details such as what 
sites specifi c users visit and how much time they spend on these sites. They can also record 
when users attempt to visit known prohibited sites. 
Change Logs
Change logs record change requests, approvals, and actual changes to a sys-
tem as a part of an overall change management process. A change log can be manually cre-
ated or created from an internal web page as personnel record activity related to a change. 

---

Logging, Monitoring, and Auditing 
775
Change logs are useful to track approved changes. They can also be helpful as part of a 
disaster recovery program. For example, after a disaster administrators and technicians can 
use change logs to return a system to its last known state, including all applied changes. 
Logging is usually a native feature in an operating system and for most applications 
and services. This makes it relatively easy for administrators and technicians to confi g-
ure a system to record specifi c types of events. Events from privileged accounts, such as 
administrator and root user accounts, should be included in any logging plan. This helps 
prevent attacks from a malicious insider and will document activity for prosecution if 
necessary.