I remember hearing that to catch a fly you have to sneak up on it — it can not feel any movement of air. That is why fly-swatters are mesh instead of solid and why you should open your fingers instead of keeping them together.
A report in the BBC illustrates this concept in a report about seal whiskers. Whales and dolphins use echolocation, but seals use their whiskers to detect and analyze the flow of water around them. They have an impressive level of sensitivity:
The seal was able sense and indicate the direction in which the fin travelled up to 35 seconds after the movement had stopped.
[…]
“They seem to be able to discriminiate [sic] between different shapes, which might even mean they discriminate between different species of fish”
It is easy to see how survival has been the impetus to develop both echolocation and whisker sensitivity. Finding food and avoiding predators are the benefits to animals of collecting and analyzing the flow of air and water.
Might be interesting to reflect on this the next time a breeze touches your skin or a faint sound can be heard in the distance. Which way is the unknown object moving? How fast? How big?
More to the point, however, is that the story is a great analogy for log management. Organizations need to stay on top of opportunities and threats. Some of the richest sources of this information can be found in the logs generated by their systems.
While it is common for an organization to see many of the opportunities (e.g. web site clicks and hits) too often I find they do not see how the same information can be used to give a clear warning of threats. That is probably because executives today have an unclear concept of catastrophic network and system threats unlike the seal, apparently which has a very clear idea of shark-ness.
Perhaps the brain allocates food detection to one area and threat avoidance to another. Which one is dominant for the seal? Which one is dominant in your organization? Can you recognize a shark using your logs and tell its size, direction and speed?