About us
Support
Contact
NewsGüvenlik
Watching logs is not automatic blocking
5 Eylül 2026 · About 3 min
An unusual sign-in is marked. A mark is a review queue; it does not close the door by itself.
A pile of files
Servers, firewalls and computers produce records every day. When the records stay in separate folders, an unusual sign-in is noticed late. The morning fact that “someone tried at night” comes out only if someone opens the file.
Log watching gathers those records in one place and marks unusual sign-ins and changes. PikSOC describes this job. A mark is a review queue. It is not a promise of automatic blocking. The software locking the door on its own also locks the office on a false alarm.
What is collected
Not every line from every device is taken on day one. Administrator sign-in, failed password tries, a new account and a critical file change do enough work. As the list grows, nobody reads. An unread mark is not a mark.
Source clocks must also match. If one is summer time and one is UTC, the order of events breaks. When the order breaks, “did the password change first, or the sign-in” stays unanswered.
What a person does
When a mark falls, someone looks. Is it authorised, a permitted scan, or a truly foreign try. That split is more procedure than software. Who will look and where they will write is clear from the start.
A small office may not have a separate security team. Then the mark falls into a support record and is read the same day. A system that will not be read is not built. The aim is not a collection of red lights on a board. The aim is to know the next morning what happened.
How long it is kept
Logs fill a disk forever. Retention is written: for example failed sign-ins for thirty days, administrator actions longer. The duration does not have to be an invented day count. The window the disk can hold and the window you would look back on when an event appears are chosen together. If they are not chosen, the system either stops or deletes the old record.
A note is written on the day a mark arrives. “I looked, it was staff” is also a close. Unread marks pile up and the next real event is lost. PikselusONE does not sell log watching as automatic blocking. Collection, a mark and a person reading are separate steps. If those three are not written, the board only lights up.
If you want the scope written for your own office, write from the contact page.