Logging Fundamentals

A log is a recording of an event. An application can record a completed request, a failed sign-in, or a configuration change. An operating system or device can record its own events. Each record preserves context that you can inspect later.

Logging turns runtime activity into evidence. You use that evidence to troubleshoot failures, investigate security events, audit important changes, and understand system behavior. A log is not the event itself. It is the record the source chose to emit.

That distinction matters. Missing records do not prove that nothing happened. A record can also be delayed, duplicated, truncated, or dropped. Treat logs as evidence with known limits.

One event, one useful record

A useful log record answers a small set of questions: