What is stacking in log analysis?

• A. The application of frequency analysis
• B. Layering logs by source
• C. Merging log files into a single stream
• D. Eliminating duplicate events

Answer: (A)

Stacking in log analysis centers on counting how often events occur and comparing those frequencies to reveal patterns or anomalies. By aggregating or stacking repeated events across time or across sources, you can spot spikes, bursts of activity, or unusual repetitions that aren’t obvious from individual log entries. This is precisely what frequency analysis does—it looks at the distribution of events to highlight behavior that stands out, such as a flood of failed login attempts or synchronized alerts.

Layering logs by source organizes data but doesn’t focus on how often events happen. Merging log files into a single stream changes the data structure rather than emphasizing repetition. Eliminating duplicates reduces noise but doesn’t illuminate recurring patterns across time or sources.