EC-Council CSA · Domain 3 of 8

EC-Council CSA Domain 3: Log Management

Log Management is 15% of CSA v2. It covers why logs matter and how they are managed, the local logs produced by operating systems, network devices, web servers, databases and mail systems, and how centralized logging collects them for analysis.

Exam weight
15%
Official objectives
5
Estimated questions estimate
~15
Suggested study time estimate
10–14 hrs

About 12 min read Reviewed October 2026

Overview

Domain 3 is about the raw material of every SOC: logs. It opens with the purpose of log management and the approaches used to generate, transmit, store, analyze and dispose of log data, including retention, time synchronization and integrity protection. Local logging is then covered by source. On Windows you need the Security, System and Application event logs, key event IDs and Sysmon; on Linux the syslog family, auth.log or secure, and the systemd journal; on macOS the unified logging system. Network devices contribute firewall allow and deny records and router logs. Web servers such as IIS and Apache, database servers and email systems each have their own formats and locations.

The final objective covers centralized logging: forwarding with agents or syslog, normalizing formats, protecting logs in transit and at rest, and storing them where a SIEM can search and correlate them.

How it's tested

Most questions are recall-and-interpret items. You are shown a log fragment or asked about a log source and must identify the event, the file or the field that matters. Others test management decisions, such as why to synchronize clocks, how long to keep data, or why to forward logs off the host.

  • What does this event mean

    An event ID, syslog line or HTTP log entry is shown, and you interpret what happened.

  • Where is it recorded

    An activity is described, and you choose the log, file path or device that would record it.

  • Manage the logs

    A requirement such as integrity, retention or correlation across hosts is described, and you pick the log management practice.

Reasoning it through

An analyst sees Windows event 4625 repeated many times for one account, followed by 4624 and then 4672 for the same account. Event 4625 records failed logons and 4624 a successful one, which suggests a guessed password. Event 4672 shows special privileges were assigned at logon, so the compromised account is privileged. Escalating as a likely successful brute force against an administrative account is the correct reading.

Objectives 5

Official objectives from the EC-Council outline, in outline order.

3.1 Understand Log Management its importance and approachesWhy logs matter and how they are handled through their life.
What it means
Log management covers generating, collecting, transmitting, storing, analyzing, retaining and disposing of log records. It supports detection, investigation, troubleshooting, accountability and compliance with standards such as PCI DSS, HIPAA and ISO/IEC 27001.
What to understand
Good practice defines which events to log, synchronizes clocks with NTP so events can be ordered across systems, protects logs from tampering with access control and hashing, and sets retention periods to meet legal and business needs. Too little logging leaves blind spots; logging everything raises cost and noise. A log management policy should name owners and review frequency.
How it shows up
Questions ask which practice solves a stated problem, such as events that cannot be correlated because timestamps disagree.
Common confusion
Assuming more logging is always better without considering storage, performance and analyst noise.
3.2 Understand and Analyze Local Logging Practices: Windows, Linux and Mac LogsOperating system logs and the events that matter most.
What it means
Windows records events in channels such as Security, System and Application, viewed with Event Viewer or wevtutil. Linux writes text logs under /var/log and the systemd journal. macOS uses the unified logging system, queried with the log command or Console.
What to understand
Key Windows IDs include 4624 successful logon, 4625 failed logon, 4634 logoff, 4672 special privileges assigned, 4688 process creation, 4720 account created, 4740 account locked out and 1102 audit log cleared. Logon type 2 is interactive, 3 network and 10 remote interactive. Sysmon adds detail such as event 1 process creation and event 3 network connection. Linux authentication goes to /var/log/auth.log on Debian-based systems and /var/log/secure on Red Hat-based systems.
How it shows up
You are given an event ID or path and asked what it shows, or asked which log holds a given activity.
Common confusion
Confusing event 4624 with 4625, or looking for SSH logins in /var/log/messages instead of auth.log or secure.
3.3 Understand and Analyze Local Logging Practices: Firewall and Router LogsNetwork device logs and what they reveal.
What it means
Firewalls log allowed and denied connections with source and destination address, port, protocol, action and rule. Routers log interface changes, routing updates, authentication and ACL matches, usually through syslog.
What to understand
Syslog severities run from 0 emergency to 7 debug, so lower numbers are more severe, and facilities identify the source subsystem. Many denies from one source to many ports suggest scanning; allowed outbound traffic to rare destinations at regular intervals may indicate beaconing. Logging every allowed packet on a busy firewall can overwhelm storage, so administrators often log denies and selected allows.
How it shows up
Firewall or router log entries are shown, and you interpret the pattern or identify the severity.
Common confusion
Reading syslog severity backwards and treating level 7 as the most critical.
3.4 Understand and Analyze Local Logging Practices: Web Server, Database, EmailApplication-tier logs for web, database and mail services.
What it means
Web servers record each request: IIS uses the W3C extended format by default, and Apache uses access logs in common or combined format plus an error log. Databases keep error, query, audit and transaction logs. Mail systems record message tracking, SMTP transactions and gateway verdicts.
What to understand
In web logs, check client IP, timestamp, method, URI and query string, status code, bytes and user agent. A burst of 404s points to scanning, 500 errors after odd input can show injection attempts, and 200 responses with large sizes may mean data was returned. Database audit logs show who ran which queries. Message tracking logs and headers reveal sender, recipients, relays and delivery outcome.
How it shows up
A web or database log entry is shown, and you identify the attack or the field that proves it.
Common confusion
Assuming a 200 status code means an attack failed; it means the server answered successfully.
3.5 Understand and Implement Centralized LoggingCollecting logs from many sources into one store.
What it means
Centralized logging forwards logs from endpoints, servers, network devices and applications to a central collector or SIEM, where they are parsed, normalized, stored and searched together.
What to understand
Collection can be agent-based or agentless. Syslog traditionally uses UDP 514, with TCP and TLS on 6514 for reliable and encrypted transport. Windows event forwarding sends events to a collector. Normalization maps different formats to common fields so correlation works. Central storage also protects evidence, because an attacker who clears local logs cannot erase copies already forwarded.
How it shows up
Expect questions on why centralization helps, which transport is secure, and what normalization achieves.
Common confusion
Treating normalization as compression; it standardizes field names and formats so events can be compared.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Event ID 4624 and 4625

    Successful and failed Windows logons.

    Remember
    A run of 4625 then 4624 suggests a guessed password.
    Tested as
    Authentication analysis questions.
    Trap
    Swapping the two IDs.

  • Event ID 4672

    Special privileges assigned to a new logon.

    Remember
    Flags administrator-level sessions.
    Tested as
    Privilege questions.
    Trap
    Treating it as a failed logon.

  • Event ID 4688

    A new process was created.

    Remember
    Needs process creation auditing enabled.
    Tested as
    Execution and malware questions.
    Trap
    Expecting it without the audit policy.

  • Event ID 1102

    The Security audit log was cleared.

    Remember
    A strong anti-forensics indicator.
    Tested as
    Defense evasion questions.
    Trap
    Treating it as routine maintenance.

  • Logon types

    Type 2 interactive, 3 network, 10 remote interactive (RDP).

    Remember
    Type 10 points to Remote Desktop.
    Tested as
    Lateral movement questions.
    Trap
    Confusing type 3 with RDP.

  • Sysmon

    Microsoft Sysinternals service that writes detailed process, network and file events.

    Remember
    Event 1 process create, event 3 network connection.
    Tested as
    Endpoint visibility questions.
    Trap
    Assuming it is installed by default.

  • auth.log and secure

    Linux authentication logs on Debian and Red Hat families.

    Remember
    SSH and sudo events land here.
    Tested as
    Linux log location questions.
    Trap
    Searching only /var/log/messages.

  • macOS unified logging

    Central log store queried with the log command.

    Remember
    Replaced most legacy text logs.
    Tested as
    Mac log questions.
    Trap
    Looking only for system.log.

  • Syslog severity

    Levels 0 emergency to 7 debug.

    Remember
    Lower number means more severe.
    Tested as
    Severity questions.
    Trap
    Reading the scale backwards.

  • W3C extended and combined log format

    Default IIS format and common Apache access format.

    Remember
    Both record IP, request, status and user agent.
    Tested as
    Web log questions.
    Trap
    Expecting request bodies in access logs.

  • NTP time synchronization

    Keeping clocks aligned across log sources.

    Remember
    Required for correlating events correctly.
    Tested as
    Log management questions.
    Trap
    Ignoring time zones and drift.

  • Normalization

    Mapping varied log formats into common fields.

    Remember
    Enables correlation across sources.
    Tested as
    Centralized logging questions.
    Trap
    Confusing it with aggregation or compression.

  • Syslog over TLS

    Encrypted, reliable syslog transport, commonly TCP 6514.

    Remember
    Plain syslog on UDP 514 is unencrypted and lossy.
    Tested as
    Secure transport questions.
    Trap
    Choosing UDP for integrity needs.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Windows logon events

ConceptMeaningKey differenceCommon trap
4624 Successful logon Check logon type and source Calling it a failure
4625 Failed logon Volume shows guessing Ignoring the failure reason code
4672 Privileged logon Admin rights assigned Missing its link to 4624
4740 Account locked out Threshold reached Treating as success

Linux and macOS log locations

ConceptMeaningKey differenceCommon trap
/var/log/auth.log Authentication on Debian and Ubuntu SSH, sudo, PAM events Using it on Red Hat
/var/log/secure Authentication on RHEL and CentOS Same role as auth.log Searching messages instead
journald systemd binary journal Queried with journalctl Expecting plain text
macOS unified log Central Apple log store Queried with log show Relying on legacy files

Syslog transport

ConceptMeaningKey differenceCommon trap
UDP 514 Traditional syslog Fast but unreliable and unencrypted Using it for sensitive logs
TCP 514 Reliable delivery Acknowledged but still plaintext Assuming encryption
TLS 6514 Encrypted syslog Reliable and confidential Forgetting certificate setup

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Status 200 means blocked

    What candidates pick
    Conclude an injection attempt failed because the server returned 200.
    Why it looks right
    Errors seem more suspicious than success.
    Why it's wrong
    A 200 means the request was processed, and a large response may show the injection worked.

    Clue to watch for Response size is unusually large.

  2. Severity scale backwards

    What candidates pick
    Treat syslog level 7 as critical.
    Why it looks right
    Higher numbers often mean higher severity elsewhere.
    Why it's wrong
    Syslog runs from 0 emergency to 7 debug, so 0 is the most severe.

    Clue to watch for A numeric syslog level appears in the stem.

  3. Local logs are enough

    What candidates pick
    Rely on host logs for an investigation of a compromised server.
    Why it looks right
    The evidence was written there originally.
    Why it's wrong
    Attackers can clear local logs; forwarded central copies are more trustworthy.

    Clue to watch for Event 1102 or missing log periods.

  4. UDP for integrity

    What candidates pick
    Choose standard syslog over UDP 514 to protect log integrity.
    Why it looks right
    It is the familiar default.
    Why it's wrong
    UDP gives no delivery guarantee or encryption; TLS-protected syslog provides both.

    Clue to watch for The requirement mentions confidentiality or reliable delivery.

  5. Normalization equals compression

    What candidates pick
    Pick normalization to reduce storage.
    Why it looks right
    Both happen during ingestion.
    Why it's wrong
    Normalization standardizes fields for correlation; compression and retention policy manage storage.

    Clue to watch for The goal is comparing events from different vendors.

  6. Logon type confusion

    What candidates pick
    Read logon type 3 as Remote Desktop.
    Why it looks right
    Both involve remote access.
    Why it's wrong
    Type 3 is a network logon such as a file share; RDP is type 10.

    Clue to watch for The scenario mentions RDP or an interactive remote session.

Answer framework

When a Domain 3 question shows a log or asks about logging, work through these steps.

  1. Identify the source type first: Windows event log, Linux or macOS log, network device, web server, database or mail system.
  2. Recall what that source records and its key identifiers, such as event IDs, file paths, syslog severities or HTTP status codes.
  3. Read the fields that change the meaning, such as logon type, response size, deny versus allow, or the account involved.
  4. Consider whether the evidence could have been altered locally, and prefer centrally forwarded copies when integrity matters.
  5. For management questions, match the need to a practice: NTP for correlation, TLS for transport, normalization for comparison and retention policy for compliance.

Practice question

During an investigation of a Windows file server, the SOC finds no Security log entries for a six-hour window. The SIEM's forwarded copy shows event 1102 at the start of that window under a domain admin account. What does this most likely indicate?

Want more like this? The EC-Council CSA practice test has questions for every domain.

Checklist

0 of 13

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

This domain rewards memorization backed by practice. Start with Windows: build a flashcard set of the key Security event IDs and logon types, then open Event Viewer on a test machine, generate a failed and successful logon, and find both events. Install Sysmon in a lab if you can, so the process and network events feel familiar.

Next work through Linux and macOS. On a Linux virtual machine, attempt SSH logins and read the result in auth.log or secure, then try journalctl. On a Mac, run log show with a short time window. Then study network devices by reading sample firewall logs and practicing the syslog severity scale until 0 to 7 is automatic.

For web, database and email logs, collect a few sample Apache and IIS lines and annotate each field. Finish with centralized logging: forwarding methods, transport ports, normalization, retention and integrity. With about fifteen questions at stake, schedule this domain early, because Domains 4 and 6 assume the knowledge.

FAQ

How much of the CSA v2 exam is Log Management?

Log Management is 15% of the blueprint, about fifteen of the 100 questions, making it the third heaviest domain.

Which Windows event IDs should I memorize?

At minimum 4624, 4625, 4634, 4672, 4688, 4720, 4740 and 1102, plus logon types 2, 3 and 10. Sysmon events 1 and 3 are also useful.

Where are Linux authentication logs stored?

In /var/log/auth.log on Debian and Ubuntu, and /var/log/secure on Red Hat, CentOS and similar systems. The systemd journal also holds them.

How are macOS logs read?

Modern macOS uses the unified logging system. Use the log show or log stream commands, or the Console app, rather than relying on legacy text files.

What is the most severe syslog level?

Level 0, emergency. The scale runs down to level 7, debug, which is the least severe.

Why centralize logs instead of reading them on each host?

Central logs allow correlation across systems, survive local tampering, simplify retention and give the SIEM one place to search.

Does this domain cover database and email logs?

Yes. The blueprint objective on web servers, databases and email covers their log types and what each reveals during an investigation.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 3 knowledge

You have covered log management practices, operating system, network, web, database and email logs, and centralized logging. Test whether you can read log evidence quickly.

Take the EC-Council CSA practice test Check your EC-Council CSA readiness

Keep going