Problem
System monitoring and the use of network traffic log files are extremely important for gauging baseline performance and observing events. Why does identifying abnormal behavior first require having a baseline? What can a log file show that lends insight into abnormal behavior?