System monitoring and the use of network traffic log files are extremely important for gauging baseline performance and observing events.  Why does identifying abnormal behavior first require having a baseline?  What can a log file show that lends insight into abnormal behavior?

Establishing a baseline is essential for understanding how the normal flow of business will show on a report. You cannot know what is abnormal without first defining what normal is. Observing traffic for one day is not sufficient data, but instead, an organization should watch what normal is after a sufficient amount of days that best will give the most data and use that as a baseline. After having a baseline one can use this for the log file to detect abnormalities as combing through all of the data presented and searching for issues can result in missing important items or overlooking them. After having normal practices you can use the log file to calculate any entries or behaviors presented to spot anything that does not seem to fit for daily practices.