Comments on: Establishing a Hardened Syslog Log Server

By: Configuring SUDO for Effective Activity Monitoring Via Syslog | Logged

Configuring SUDO for Effective Activity Monitoring Via Syslog | Logged — Fri, 05 Feb 2010 22:26:45 +0000

[...] cover his tracks by deleting logs. This is best accomplished by streaming the logs to a hardened syslog server, where the administrator doesn’t have the ability to delete [...]

By: Building A Program To Manage And Monitor Administrators | Logged

Building A Program To Manage And Monitor Administrators | Logged — Sun, 24 Jan 2010 21:46:26 +0000

[...] user monitoring program”, defined later. Following the good practice of sending logs to a hardened log server for storage and processing will prevent determined administrators from covering his tracks by [...]

By: Using Syslog Logs For Validation of Security Policy Compliance | Logged

Using Syslog Logs For Validation of Security Policy Compliance | Logged — Fri, 07 Aug 2009 21:49:26 +0000

[...] ability to remove the log evidence of his presence, which is a very good reason to relay logs to a central syslog server. It then becomes imperative that administrators with access to root accounts on systems do not [...]