Log Sources

A log is a record written by a system when something happens — a user signs in, a firewall blocks a connection, a service fails, a configuration changes. A log source is any system that produces these records.

Logs are one of the two data inputs of SentriaOne xSIEM. The other is raw network traffic, described in Packet Mirroring.

From source to analysis

1. Source — a device or service records an event in its own log format.
2. Collection — the log is forwarded to, or retrieved by, the platform.
3. Ingest and process — the log is parsed, normalized into a consistent structure, enriched with context, and stored for search. See Data Processing.
4. Analysis — the processed log is correlated with other data to detect threats and support investigation. See SIEM.

Types of log sources

End devices

End devices are the systems where users and workloads actually run.

Source	Typical events recorded
Endpoints	User sign-in/sign-out, process execution, security software events
Servers	Authentication, service start/stop, privilege use, application errors
Virtual machines	The same events as physical servers, from virtualized workloads
Containers (Docker)	Container lifecycle events and application output

Network devices

Network devices move and filter traffic between systems. Their logs describe who communicated with whom and what the device decided to do.

Source	Typical events recorded
Firewalls	Allowed and denied connections, policy matches, NAT translations
Security perimeter devices	Web application firewall (WAF) blocks, intrusion prevention events
Routers and switches	Interface up/down, routing changes, configuration changes

Other sources

Source	Typical events recorded
Cloud services	Account activity, resource changes, access to cloud resources
Applications	Application-specific audit trails, transactions, and errors

Common collection methods

The following methods are widely used across the industry to move logs from a source to a log management platform.

Method	How it works
Syslog	The source pushes log messages over the network to a receiver
Agent-based	A lightweight agent installed on the host reads local logs and forwards them
API-based	The platform pulls logs from a service's API, common for cloud services
File-based	Log files are read from a shared or local location

note

This table describes general industry methods. For configuration examples, see Sending Logs (Syslog). The collection methods and source types supported by SentriaOne xSIEM are documented in the Integration section.

Anatomy of a log

Every source uses its own format, but most logs contain the same kinds of information. The example below is a generic, illustrative firewall log line.

<134>1 2026-01-15T08:42:11Z fw-edge-01 firewall - - - action=deny src=10.10.20.15 dst=203.0.113.50 dport=445 proto=tcp

Part	Meaning in the example
Timestamp	2026-01-15T08:42:11Z — when the event happened
Host	fw-edge-01 — which device reported the event
Action / event type	action=deny — what happened
Source and destination	src, dst — which systems were involved
Service details	dport=445, proto=tcp — port and protocol

Because each vendor names these fields differently, logs must be normalized before they can be searched and correlated together.

Logs and raw traffic compared

Aspect	Logs	Raw traffic (packet mirroring)
Produced by	The device or application itself	A copy of packets taken from the network
Content	What the system chose to record	What actually crossed the network
Coverage gaps	Devices that do not log, or logging disabled	Network segments that are not mirrored
Typical use	SIEM correlation, audit, compliance	NDR, network traffic analysis, NPM

Using both gives a more complete view: logs explain what systems reported, while traffic shows what actually happened on the wire.