Log management is the practice of collecting, storing, protecting, analyzing, and retaining system and security logs. Those logs record the small events that add up to a story: authentication attempts, configuration changes, network connections, and application activity that becomes essential during monitoring, investigations, and forensics.
Doing it well means picking the right sources, getting them to a central place reliably, and protecting the logs from tampering, because an attacker who can edit or delete logs can erase their own footprints. Retention is a balancing act between compliance mandates, storage cost, and how far back an investigation might need to reach. Centralized aggregation then feeds a SIEM for correlation and alerting. A common trap is collecting everything and reviewing nothing; volume without analysis just raises your storage bill while the real signal sits unread.
Why does log management matter for the CISSP exam?
Log management shows up in Domain 7: Security Operations and in Security Assessment and Testing. Know your log sources, integrity and access protections, retention driven by compliance, and why logs are usually the primary evidence in an incident. NIST covers the topic in SP 800-92.
Related terms: SIEM, Incident Response