## Anatomy of a Log: Reading the Matrix

A log is just a text record of "Software doing something".

### The 3 Pillars of Observability
1.  **Logs**: Discrete events (The error happened at 2:01 PM).
2.  **Metrics**: Aggregated numbers (CPU usage was 80%).
3.  **Traces**: The journey of a request across services.

### Common Log Formats
*   **Syslog (The Standard)**: `Dec 29 10:00:00 hostname sshd[1234]: Failed password for root from 1.2.3.4`.
*   **JSON (The Modern)**: `{"timestamp": "2025-12-29T10:00:00", "host": "web01", "level": "ERROR"}`.
*   **CEF (Common Event Format)**: Used by ArcSight. `CEF:0|Vendor|Product|Version|ID|Name|Sev|Extension`.

### Why Analysts Hate Unstructured Logs
If a developer logs: `Error: Something bad happened.`
*   It tells you **nothing**.
*   A good log answers: **Who? What? Where? When?**

### The Timestamp Problem
*   **Timezones**: Is the log in UTC or EST? If you correlate a UTC firewall log with an EST server log, you will be 5 hours off, and you will miss the attack.
*   **Rule**: Always set servers to UTC.