Logging and monitoring have two purposes, one is to catch malicious activity as it happens and the other is to reveal previously undetected malicious activities after the fact. Live monitoring requires inputs from both hardware and software and these reporting messages are termed “logs.” A monitoring system needs to collect these messages and search through them for specific activities. Each monitoring system is produced with different aims and so some activities might not be spotted immediately – the operating search algorithm might not be searching for that specific type of behavior. Although missing an attack as it happens is a failure of system security, being able to discover that an attack has occurred is important because it renewables system managers to take steps to close security loopholes – better late than never.