Log analysis needs to be done regularly in order to detect problems in a timely manner. This is not easy, because logs can quickly grow in size. Consequently, system administrators use a number of software tools to efficiently strip out routine log entries so that they can focus their attention on anomalous behavior that might represent signs of an intrusion. In addition. most organizations are supplementing log analysis with software tools, called intrusion detection systems, to automate the monitoring process.