What is the primary purpose of centralized log management?

• A. To distribute logs across many servers
• B. To store logs in a central repository for correlation
• C. To automatically delete old logs
• D. To bypass monitoring

Answer: (B)

Centralized log management is about pulling logs from multiple devices and applications into one central repository so that events can be correlated and analyzed together. When logs sit in disparate places, it’s hard to connect related activity across systems, making it slower to detect coordinated attacks, reconstruct timelines, or run comprehensive investigations and audits. Having a single, searchable store enables efficient correlation, forensics, and compliance reporting, and often supports automated analytics and alerting.

Distributing logs across many servers keeps data scattered and hinders cross-system analysis. Automatically deleting old logs touches retention policies rather than the core purpose of enabling cross-source correlation. Bypassing monitoring would defeat the whole security objective and isn’t a legitimate aim.