Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am interested in any training involved with system logging, log catching, network device logging, log extraction, log analysis, log presentation... and so forth. I am looking to focus on all things involved with system monitoring and alerting, as well as historical review of various system metrics.

Does anybody work in such a position? What is your title? What would be a good title for such a position?

UPDATE I am asking this in an attempt to figure out what sort of training I might want to pursue in a focus on what amounts in a vague sense to "system analysis" I use Splunk to index all sorts of logs, and I am finding that it is somewhat tricky working with all the various systems in the environment... the best way of interrogating the information, than working over it to generate insight.

share|improve this question
Why is this a Community Wiki?? – Chris S Aug 18 '10 at 19:07
Maybe some kind of forensic specialist in law enforcement? – Zoredache Aug 18 '10 at 19:14
I might be displaying ignorance of the purpose of Community Wiki, but I made it wiki because I thought it was a sort of a subjective, not exactly server admin sort of topic. – MattUebel Aug 18 '10 at 20:05
CWs are for building a base of knowledge, without asking a question or where the question is largely rhetorical. – Chris S Aug 18 '10 at 20:15
roger that, thanks – MattUebel Aug 18 '10 at 20:32
up vote 2 down vote accepted

Most positions centered around reviewing audit trails and logs are security analysts or administrators of various types. In IT, the responsibilities are security focused and it's usually entry to mid level positions.

share|improve this answer

I doubt there's too many jobs around that solely focus on system logs. It's basically required of every sysadmin to keep track of his own logs; though if the organization is large enough they might have a person or two dedicated to logging functions. These people would more than likely come from sysadmin backgrounds and would not have simply started in the area.

share|improve this answer
Plenty of security jobs out there. – Warner Aug 18 '10 at 19:23
@Warner, I wouldn't think they'd hire people who only review logs though; I would think they'd be, well, Security Experts and a part of that job is Logs. I'm sure there are a few out there, but I can't imagine they'd ever hire someone without prior admin experience. – Chris S Aug 18 '10 at 20:00
I'd call SNORT's review logs but in large corp, there's not much of a difference. =) – Warner Aug 19 '10 at 17:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.