Logging

First principles

A log is a contemporaneous record: written at the time of the event, not reconstructed later from memory. That is why it can be evidence. A screenshot of a console after the fact is a story. Auth success and failure, admin actions, backup and restore jobs, mail send and receive — those answer who did what, when, from where.

Time is part of the record. If clocks disagree, you cannot order events across hosts. NTP (or equivalent) is not decoration. Put every system on a source you control or a public one you name, and alert when a clock walks.

If they can delete it, it is not evidence

Logs that live only on the host they describe die with the host. An attacker with admin on that host can empty the file. Ship copies off-box as they are written: another host, an object store the host role cannot delete, a SIEM whose admins are a different identity. Retention is a policy. Integrity is a different identity.

What an admin actually does

• Collect: authentication (including MFA and VPN), privileged use, backup and restore, mail gateway, DNS, firewall allows and denies at the edge, cloud audit logs.
• Ship off-host. The source host may keep a local tail. The copy you will trust in an incident is elsewhere.
• Sync time. Confirm it. A log line without a trustworthy timestamp is a rumour with a date stamp.
• Name an owner for the queue. Unread logs are storage. Detection is a person or a rule that reads them.