Understanding log formats

At the beginning of this chapter, we discussed how logs keep track of the four Ws related to an event. These were the when, where, who, and what of the event. Let's understand how each of these is done in a bit more detail in the following table:

	Attribute	Remarks
When	Log date and time Event date and time	The log date and time can be different from that of an event in some cases, such as in situations where the event data is remotely collected at intermittent times
Where	Application ID Application address Service Geolocation Window/ webpage/ form	Application name and version System or server name, IP address, port number, and local device ID Name and protocol Latitude and longitude, where applicable Entry-point URL, webpage entry-point URL, dialogue box, and so on
Who	Code location	Path and name of the code module/script
What	Event type Event severity Event flag Event description	For example, log in, log out, access, delete, and so on For example...