3.6.1. Performance Monitoring and Event Logs

💡 First Principle: Event logs are the server's internal diary—every significant system event is recorded. Monitoring systems aggregate these logs across many servers and alert on patterns. Without monitoring, you're managing reactively; with it, you're managing proactively.

Performance Monitoring

Performance monitoring tracks resources over time:

• Uptime monitoring: Alerts when a server stops responding. The most basic form—"is the server alive?"
• Threshold-based alerting: Define acceptable ranges for CPU, memory, disk, and network. Alerts fire when metrics exceed thresholds.
• Trend analysis: Compares current metrics against historical baseline to identify gradual degradation.

Event Logs

Windows Event Viewer and Linux syslog/journald capture detailed records of system events. Key concepts:

• Configuration: Which events to log (log level, verbosity). Too little logging misses important events; too much logging fills disk.
• Log shipping: Forwarding logs in real-time to a centralized log server or SIEM. Critical for security monitoring and compliance.
• Alerting: Triggering notifications when specific events occur (e.g., failed login attempts, service failures, disk errors).
• Reporting: Periodic summaries of log events for management and compliance.
• Retention: How long logs are kept. Compliance requirements often mandate minimum retention periods (30, 90, or 365 days depending on regulation).
• Rotation: When logs reach a size limit, old logs are archived or deleted and a new log file begins. Prevents a single log file from growing indefinitely.

SIEM (Security Information and Event Management)

SIEM systems (Splunk, Microsoft Sentinel, IBM QRadar) aggregate logs from multiple sources, apply correlation rules to identify attack patterns, and provide centralized visibility. For Server+, know that SIEM is the tool for log analysis at scale—individual server log review doesn't scale to enterprise environments.

⚠️ Exam Trap: Logs that aren't retained can't be used for forensic investigation after a security incident. An organization that deletes logs after 7 days may not be able to prove (or even investigate) a breach that was discovered after 30 days.

Reflection Question: A security incident is discovered today, but the breach is suspected to have occurred 45 days ago. The organization only retains logs for 30 days. What investigative capability has been lost?