Chapter 3 of 8 · EC-Council 312-39
Log Management
Log approaches, Windows, Linux and Mac logs, device, web, database and email logs, and central logging.
- 5topics
- 25 minfast track
- 1diagrams and exhibits
- 15%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Log Management Importance and ApproachesLearn why log management matters to a SOC, the log management process, local versus centralized approaches, syslog severity…5 min
- 2Windows, Linux and Mac LogsLearn Windows event logs, key event IDs and logon types, Sysmon, Linux log files under /var/log and macOS unified logging for SOC…5 min
- 3Firewall and Router LogsLearn firewall log fields, Windows Firewall, iptables and Cisco ASA and IOS log messages, and the patterns that reveal scans and…5 min
- 4Web Server, Database and Email LogsLearn IIS W3C and Apache log formats, HTTP status codes, database audit and error logs, and mail server logs and headers for SOC…5 min
- 5Centralized LoggingLearn centralized logging for a SOC: agent and agentless collection, syslog and Windows Event Forwarding, normalization, time…Diagram5 min
About this chapter
What this chapter covers
Log Management is 15% of the EC-Council CSA 312-39 exam. It covers why logs matter and the approaches to managing them, reading Windows, Linux and Mac logs, analyzing firewall and router logs, analyzing web server, database and email logs, and building centralized logging that feeds the SIEM.
Questions are single-answer multiple choice, often "Which of the following" and short named scenarios. You are asked what a log entry, event ID or status code means, where a log is stored, or what the next triage step is after reading it.
It has 5 outline topics, and five pages cover them.
How the topics fit together
Every detection in the SOC starts with a log. The chapter follows logs from the source to the central store.
The first page sets the process and the rules for keeping logs. The middle pages teach you to read each log type, and the last page joins them into one central pipeline.
Memorize a short list of facts that appear again and again: Windows event IDs 4624, 4625, 4688, 4720 and 1102, logon types 2, 3 and 10, syslog severities 0 to 7, the Linux auth log locations, and HTTP status codes 401, 403, 404 and 500.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorize.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Try to name the next step for each short scenario before reading the answer. The exam often asks what to do first, or which tool fits.
Ready for more practice?
The full EC-Council 312-39 question bank has 700 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.