Logs are time-stamped records of events or actions inside a system. They may record user logins, process starts, file changes, network connections, errors, and security alerts. In modern environments, logs are a core part of observability because they help operators reconstruct what happened after the fact.
In cyber security, logs matter because they provide evidence. Defenders use them to detect suspicious behavior, investigate incidents, confirm whether a control worked, and build alerts around known attack patterns. Attackers often try to delete, alter, or avoid logging so their activity is harder to trace. Good logging therefore depends on coverage, integrity, retention, and access control; if logs are incomplete or tampered with, investigations can miss key steps and security teams lose visibility.