My company is going through an audit and I have taking over the role of Linux systems administrator unofficially. I see our current logging system has it to were we basically keep a months worth of logs that rotate and previous months get deleted. I need to keep a years worth of logs for the following,
- Log activity to track log-ins and the commands they run
- Log any changes to our production Linux systems. like version/kernel changes. Any changes that would directly change linux or add features.
Right now we have basic logging of
I see we have some audit logs which are also kept at just a monthly basis.
I don't see any special packages installed to do any type of logging outside of what seems default in CentOS.
If anyone could be of assistance identifying which logs would may capture the information above, or if a special package needs to be installed to do so, that would be great. In addition, because the log files could potentially grow to large, what would be the best way to store logs externally from Linux itself?