In which log collection mechanism, the system or application sends log records either on the local disk or over the network.

In a push-based log collection mechanism, the log-generating system (the client) initiates the connection and actively sends, or "pushes," its log data to a centralized log collector or server. This method is described in the question where the "system or application sends log records." A common protocol that uses this model is Syslog, where devices forward their event messages to a central Syslog server as they are generated. This approach is often implemented using agents installed on the source systems.

A. rule-based: This term describes a method for processing or analyzing logs (e.g., correlation rules in a SIEM), not a collection mechanism.
B. pull-based: In this model, the central collector initiates the connection to the source system to retrieve, or "pull," the logs.
D. signature-based: This is a method of threat detection used by systems like IDS/IPS, where traffic is matched against known malicious patterns.

1. Kent, K., & Souppaya, M. (2006). Guide to Computer Security Log Management (NIST Special Publication 800-92). National Institute of Standards and Technology. Section 3.2.2, "Log Transportation," describes both push and pull methods for centralized logging, defining the push method as the log source initiating the transfer.

2. Massachusetts Institute of Technology. (2016). 6.858 Computer Systems Security, Fall 2014. MIT OpenCourseWare. Lecture 20, "Logging and Auditing." The lecture notes discuss logging architectures, including agent-based (push) and agent-less (pull) collection.