A log records an observation, not objective truth
A log is one system's account of what it noticed, from its own point of view, with its own clock.
It can be incomplete, mistaken or deliberately altered, and it certainly does not record what it was never instructed to look for. Treating logs as an authoritative record of events rather than as testimony from a particular witness leads investigations to state as fact things that are only what one machine believed.
More on Logging and telemetry
- Central logging reduces local erasure riskIt left before you got there
- Verbose logging can leak secretsEverything, including that
- Retention determines how far back you can investigateThe line only goes back so far
- Telemetry coverage should map to detection questionsPoint it at the question
- Parsing errors can silently break detectionsSilence is not the same as clear
- High-volume logs can hide high-value eventsBuried by the ordinary