A log server is a centralized system that collects, stores, processes, and analyzes security and event logs from hosts, applications, network devices, and security tools. By keeping logs in one place, it gives defenders a consistent record of authentication attempts, policy changes, alerts, and system activity.
Log servers matter because logs are often the first evidence of compromise and the main source for incident response, auditing, and compliance. Attackers may try to delete, alter, flood, or block logs to hide malicious actions, while defenders protect log servers with strict access control, encryption, retention rules, and tamper-resistant storage. In security platforms, a log server can be especially sensitive because it helps preserve the trail used to investigate attacks and verify what happened across the environment.