Read the log before you reinstall
Failed logins, full disks, wrong clocks. The text file is still the witness.
When a machine misbehaves, the log is the witness. Authentication failures, crashes, mail that would not send, a VPN that dropped at 2 a.m. Old operators opened `/var/log` before they opened social media. The files are still there, even when the UI hides them behind an Event Viewer.
What you are looking for
Repeated failed logins from one IP. A service that restarted in a loop. A disk that filled up. A cron job that has been erroring for a month while nobody read mail from root. Windows Event Viewer is noisy. Filter by the hour you cared about, not by the whole week.
On a home router the log is usually a circular buffer. You will not get a year of history. You will get “someone hit the admin page” if you look soon after. That is still useful.
Do not paste raw logs into a public forum with IPs, emails, and session tokens still in them. Redact. The log that helps you debug can also be a map of your network.
Time is a setting
If the clock is wrong, the log is fiction. NTP exists so that four machines agree what “Tuesday 18:03” means. After an incident, people argue from timestamps. Wrong clocks make that argument stupid.
Keep logs on a different disk or a small remote box if the machine you care about is the one that just got wiped. Ransomware that encrypts the OS disk also encrypts the local log. A copy that left the box an hour ago is the only memory you have.
You do not need a SOC
A household needs two habits. Glance at the router client list if the WiFi feels haunted. Glance at sign in history on email if a reset mail arrives. Servers need more: failed SSH, disk space, whether backups actually ran.
The glamorous part of security is the tool with a dashboard. The useful part is often a text file that says, plainly, what happened. Read it before you reinstall. Reinstall if you must. Then read the copy you stored somewhere else.