{"id":3784,"date":"2025-05-07T14:04:49","date_gmt":"2025-05-07T12:04:49","guid":{"rendered":"https:\/\/logmanager.com\/?p=3784"},"modified":"2026-05-14T11:35:24","modified_gmt":"2026-05-14T09:35:24","slug":"jak-na-logovani-typy-logu-zdroje-co-logovat","status":"publish","type":"post","link":"https:\/\/logmanager.com\/cs\/blog\/log-management\/jak-na-logovani-typy-logu-zdroje-co-logovat\/","title":{"rendered":"Jak na logov\u00e1n\u00ed? Typy log\u016f, zdroje a co byste m\u011bli logovat"},"content":{"rendered":"\n

Logy jsou kl\u00ed\u010dov\u00fd n\u00e1stroj pro spr\u00e1vu a zabezpe\u010den\u00ed IT prost\u0159ed\u00ed. V tomto \u010dl\u00e1nku vysv\u011btl\u00edme, co jsou to logy, jak\u00e9 jsou z\u00e1kladn\u00ed typy log\u016f, co by se m\u011blo logovat a z jak\u00fdch zdroj\u016f je sb\u00edrat, aby bylo mo\u017en\u00e9 logov\u00e1n\u00ed efektivn\u011b vyu\u017e\u00edt pro zachov\u00e1n\u00ed hladk\u00e9ho chodu organizace.<\/p>\n\n\n

\n
\n \n \n \n \n <\/g>\n \n \n \n <\/clipPath>\n <\/defs>\n <\/svg>\n <\/div>\n \n

TL;DR<\/strong><\/p>\n

Logy zaznamen\u00e1vaj\u00ed ud\u00e1losti generovan\u00e9 opera\u010dn\u00edmi syst\u00e9my, aplikacemi, s\u00ed\u0165ov\u00fdmi za\u0159\u00edzen\u00edmi, cloudy, bezpe\u010dnostn\u00edmi a dal\u0161\u00edmi n\u00e1stroji. IT t\u00fdm\u016fm umo\u017e\u0148uj\u00ed monitorovat provoz, odhalovat probl\u00e9my a analyzovat bezpe\u010dnostn\u00ed incidenty.<\/p>\n

Efektivn\u00ed strategie logov\u00e1n\u00ed spo\u010d\u00edv\u00e1 ve sb\u011bru log\u016f z r\u016fzn\u00fdch zdroj\u016f a ve spr\u00e1vn\u00e9m v\u00fdb\u011bru ud\u00e1lost\u00ed, kter\u00e9 maj\u00ed skute\u010dnou hodnotu pro provoz, bezpe\u010dnost i compliance organizace.<\/p>\n

Samotn\u00e9 logov\u00e1n\u00ed je t\u0159eba centralizovat pomoc\u00ed log management n\u00e1stroje, aby bylo mo\u017en\u00e9 s logy d\u00e1le pracovat, nap\u0159\u00edklad vytv\u00e1\u0159et alerty p\u0159i ne\u017e\u00e1douc\u00edch ud\u00e1lostech, analyzovat incidenty nebo je dlouhodob\u011b ukl\u00e1dat v bezpe\u010dn\u00e9m \u00falo\u017ei\u0161ti pro pln\u011bn\u00ed regulatorn\u00edch po\u017eadavk\u016f.<\/p>\n<\/div>\n<\/div>\n\n\n\n

<\/p>\n\n\n\n

Co to jsou logy?<\/h2>\n\n\n\n

Logy jsou strukturovan\u00e9 digit\u00e1ln\u00ed z\u00e1znamy o stavech a ud\u00e1lostech, kter\u00e9 generuje ka\u017ed\u00e1 \u010d\u00e1st IT prost\u0159ed\u00ed, od opera\u010dn\u00edch syst\u00e9m\u016f p\u0159es aplikace a\u017e po s\u00ed\u0165ov\u00e9 a bezpe\u010dnostn\u00ed prvky. IT administr\u00e1tor\u016fm umo\u017e\u0148uj\u00ed logy detailn\u011b sledovat chov\u00e1n\u00ed syst\u00e9m\u016f, identifikovat odchylky od norm\u00e1ln\u00edho provozu a v\u010das odhalit bezpe\u010dnostn\u00ed nebo provozn\u00ed incidenty.<\/p>\n\n\n\n

<\/p>\n\n\n\n

\"raw<\/figure>\n\n\n\n

Obr. 1: P\u0159\u00edklad toho, jak m\u016f\u017ee vypadat log v p\u016fvodn\u00ed textov\u00e9 podob\u011b (form\u00e1t syslog).<\/em><\/p>\n\n\n\n

Logov\u00e1n\u00ed poskytuje administr\u00e1tor\u016fm d\u016fle\u017eit\u00e9 informace pro spr\u00e1vu, dohled a zabezpe\u010den\u00ed IT prost\u0159ed\u00ed. Mezi typicky sb\u00edran\u00e9 logy pat\u0159\u00ed nap\u0159\u00edklad:<\/p>\n\n\n\n

\u2192<\/strong> Syst\u00e9mov\u00e9 logy: <\/strong>Zaji\u0161\u0165uj\u00ed p\u0159ehled o chodu opera\u010dn\u00edch syst\u00e9m\u016f. M\u011bly by obsahovat informace o spu\u0161t\u011bn\u00ed a zastaven\u00ed slu\u017eeb, syst\u00e9mov\u00fdch chyb\u00e1ch, aktualizac\u00edch a zm\u011bn\u00e1ch konfigurace.<\/p>\n\n\n\n

\u2192<\/strong> Aplika\u010dn\u00ed logy:<\/strong> Poskytuj\u00ed podrobnosti o chov\u00e1n\u00ed aplikac\u00ed, v\u010detn\u011b chyb, varov\u00e1n\u00ed, \u00fasp\u011b\u0161n\u00fdch \u010di ne\u00fasp\u011b\u0161n\u00fdch pokus\u016f o p\u0159ipojen\u00ed a specifick\u00fdch aplika\u010dn\u00edch ud\u00e1lost\u00ed.<\/p>\n\n\n\n

\u2192<\/strong> Bezpe\u010dnostn\u00ed logy: <\/strong>M\u011bly by zahrnovat \u00fadaje o p\u0159ihl\u00e1\u0161en\u00ed a odhl\u00e1\u0161en\u00ed u\u017eivatel\u016f, pokusech o neopr\u00e1vn\u011bn\u00fd p\u0159\u00edstup, zm\u011bn\u00e1ch v opr\u00e1vn\u011bn\u00edch, detekci malwaru nebo neobvykl\u00fdch aktivit\u00e1ch.<\/p>\n\n\n\n

\u2192<\/strong> S\u00ed\u0165ov\u00e9 logy:<\/strong> Sleduj\u00ed komunikaci mezi za\u0159\u00edzen\u00edmi v s\u00edti a mohou obsahovat informace o pokusech o naru\u0161en\u00ed, zm\u011bn\u00e1ch v nastaven\u00ed firewallu nebo aktivit\u00e1ch VPN.<\/p>\n\n\n\n

\u2192<\/strong> Logy z firewall\u016f, IDS\/IPS a dal\u0161\u00edch bezpe\u010dnostn\u00edch za\u0159\u00edzen\u00ed:<\/strong> Z\u00e1znamy o ne\u00fasp\u011b\u0161n\u00fdch pokusech o p\u0159ipojen\u00ed, pokusech o exploity a sledov\u00e1n\u00ed podez\u0159el\u00fdch aktivit.<\/p>\n\n\n\n

\"syslog<\/figure>\n\n\n\n

Obr. 2: N\u00e1stroje pro centralizovan\u00fd log management agreguj\u00ed logy z r\u016fzn\u00fdch syst\u00e9m\u016f, aplikac\u00ed, infrastruktury a bezpe\u010dnostn\u00edch \u0159e\u0161en\u00ed, p\u0159i\u010dem\u017e informace z p\u016fvodn\u00edch raw dat interpretuj\u00ed a zobrazuj\u00ed ve srozumiteln\u00e9 podob\u011b. Zde dashboard zobrazuj\u00edc\u00ed autentiza\u010dn\u00ed ud\u00e1losti nap\u0159\u00ed\u010d organizac\u00ed.<\/em> (Logmanager)<\/em><\/p>\n\n\n\n

<\/p>\n\n\n\n

Pozn\u00e1mka:<\/strong><\/em><\/p>\n\n\n\n

Ka\u017ed\u00e9 za\u0159\u00edzen\u00ed, slu\u017eba \u010di aplikace loguj\u00ed ud\u00e1losti trochu jinak. Jin\u00fdmi slovy, je b\u011b\u017en\u00e9, \u017ee ka\u017ed\u00fd v\u00fdrobce za\u0159\u00edzen\u00ed\/syst\u00e9mu\/aplikace vytv\u00e1\u0159\u00ed zpr\u00e1vu (log) jin\u00fdm zp\u016fsobem, tedy s r\u016fzn\u00fdmi polo\u017ekami a jinak popsan\u00fdmi z\u00e1znamy o ud\u00e1lostech. Loguje se nav\u00edc v r\u016fzn\u00fdch form\u00e1tech, kdy nej\u010dast\u011bj\u0161\u00ed je syslog<\/a> (op\u011bt m\u016f\u017ee m\u00edt r\u016fznou podobu v z\u00e1vislosti na zdroji), JSON, CEF a LEEF.<\/em><\/p>\n\n\n\n

Co by se m\u011blo logovat<\/h2>\n\n\n\n

Efektivn\u00ed logov\u00e1n\u00ed nestoj\u00ed jen na sb\u011bru dat, ale tak\u00e9 na v\u00fdb\u011bru t\u011bch spr\u00e1vn\u00fdch informac\u00ed. To, co se loguje, ur\u010duje, jak rychle dok\u00e1\u017e\u00ed IT t\u00fdmy reagovat na incident, odhalit chybu nebo vysledovat ne\u017e\u00e1douc\u00ed zm\u011bny v syst\u00e9mu.<\/p>\n\n\n\n

Kl\u00ed\u010dov\u00e9 je proto zam\u011b\u0159it se na ud\u00e1losti, kter\u00e9 maj\u00ed re\u00e1ln\u00fd dopad na bezpe\u010dnost, dostupnost a spr\u00e1vu IT prost\u0159ed\u00ed.<\/p>\n\n\n\n

Mezi ty nejd\u016fle\u017eit\u011bj\u0161\u00ed pat\u0159\u00ed nap\u0159\u00edklad aktivita u\u017eivatel\u016f, zm\u011bny v konfigurac\u00edch, chybov\u00e9 stavy \u010di s\u00ed\u0165ov\u00e1 komunikace. Pr\u00e1v\u011b tyto z\u00e1znamy tvo\u0159\u00ed z\u00e1klad pro auditn\u00ed stopu, detekci hrozeb i proaktivn\u00ed \u00fadr\u017ebu syst\u00e9m\u016f.<\/p>\n\n\n\n

Pro lep\u0161\u00ed p\u0159edstavu si uve\u010fme n\u011bkter\u00e9 konkr\u00e9tn\u00ed typy ud\u00e1lost\u00ed, kter\u00e9 by v r\u00e1mci spr\u00e1vn\u011b nastaven\u00e9ho logov\u00e1n\u00ed nem\u011bly chyb\u011bt.<\/p>\n\n\n\n

Bezpe\u010dnost a detekce hrozeb<\/strong><\/h3>\n\n\n\n