I see a fair number of people searching around looking for how they should be treating their logs Below is a list of best practices for log management. Like other best practices, they are not meant to be adopted blindly, but rather evaluated for how each fits into your environment.
- Forward syslog messages from clients to a secure syslog server
- Enable NTP clock synchronization on all clients and on the syslog server. It is very important for all clocks reporting logs to be using the same time server.
- Group “like sources” into the same log file. (i.e. mail server, spamassassin, mail A/V scanner all report to one file)
- Use an automated tool to establish a baseline of your logs and escalate exceptions as appropriate (i.e. like Devialog)
- Review your records retention policy, if applicable, and determine if anything kept in logs falls under that policy. If so, establish retention periods based on the records policy.
- In the absence of a records retention policy, rotate logs every day, keeping at least the last 30 days for later reference.
- Include logs and log archives in a standard backup process.
- Change read/write permissions on logs files so they are not generally accessible to unprivileged user accounts.