What is log normalization?

• A. The process of aggregating logs into a central repository
• B. The process of changing log formats into a standard format across devices and sources
• C. Tagging logs with severity levels
• D. Deleting duplicate log entries

Answer: (B)

Log normalization is the process of converting logs from diverse devices and systems into a standard format so they can be analyzed together. The idea is to unify fields like timestamp, source, event type, and message into a consistent structure, even when the original logs use different formats or field names. This standardization makes it possible to aggregate, parse, and correlate events across multiple sources in a SIEM or analytics tool, improving detection and investigation capabilities. It also reduces ambiguity and simplifies automated parsing and querying.

Aggregation into a central repository is about collecting logs in one place, but not necessarily making their formats uniform. Tagging logs with severity levels is labeling information about importance, not normalizing structure. Deleting duplicate log entries is deduplication, which removes redundancy rather than standardizing formats.