What is it?
Security logging and monitoring is the practice of collecting events from firewalls, switches, routers and servers (usually via syslog) into a central system — often a SIEM (Security Information and Event Management) platform — so security teams can detect, investigate and respond to incidents instead of just relying on individual devices blocking traffic silently.
Why should I learn it?
Blocking a threat once doesn’t tell you if it’s a one-off scan or the start of a targeted attack. Logging is what turns isolated device events into an investigable timeline — and “how would you know if you were breached?” is a very common security interview question.
How it works
Devices generate logs for key events (denied connections, failed logins, config changes) → logs are forwarded via syslog to a central log server or SIEM → the SIEM correlates events across multiple devices → alerts are raised for patterns that a single device log alone wouldn’t reveal (e.g. failed logins across ten devices in one minute).
Real-world example
A single firewall log showing one blocked connection attempt looks unremarkable. But when a SIEM correlates the same source IP being blocked across twenty different firewalls within a minute, it reveals a coordinated scan — something no single device could show on its own.
Troubleshooting mindset
When investigating an incident, don’t rely on memory of what a device “should” have done — pull the actual logs and confirm what happened, in what order, on which device.
Common mistake
Do not memorise the definition without connecting it to packet flow, device state and verification. Ask: what should happen, what actually happened, and which command or capture can prove the difference?
Quick recap
- Understand the job of the protocol or feature.
- Know where it sits in the traffic path.
- Verify behaviour instead of guessing.
- Connect the topic to the next networking layer.
Interview connection
Explain the concept in simple words first. Then give one practical example or troubleshooting check. That is stronger than repeating a textbook definition.
References & Further Reading
- AddySec original content — written for the Network Security track to build practical, interview-ready understanding.
Apni Bhasha mein samjho
Firewall ne traffic block kar diya, matlab kaam khatam nahi hua. Logs hi batate hain ki kitni baar, kahan se, aur kya try ho raha tha.
Kaise padho?
Concept ko pehle flow ke saath samjho. Phir English note ke technical terms, commands aur tables dekho — technical terminology same rahegi.