The paper presents a method for assessing the security level of an IT system based on the analysis of system event registers called logs. For the purposes of the proposed method categories of recorded events are identified and then - based on the analysis of logs from a specific past period - the values of their selected characteristics are calculated, which may be helpful in assessing the security of the IT system for the assumed levels of security. The presented considerations are illustrated with a simple numerical example.