My company is going through an audit and I have taking over the role of Linux systems administrator unofficially. I see our current logging system has it to were we basically keep a months worth of logs that rotate and previous months get deleted. I need to keep a years worth of logs for the following,

  • Log activity to track log-ins and the commands they run
  • Log any changes to our production Linux systems. like version/kernel changes. Any changes that would directly change linux or add features.

Right now we have basic logging of /var/log/messages and /var/log/secure. I see we have some audit logs which are also kept at just a monthly basis. I don't see any special packages installed to do any type of logging outside of what seems default in CentOS.

If anyone could be of assistance identifying which logs would may capture the information above, or if a special package needs to be installed to do so, that would be great. In addition, because the log files could potentially grow to large, what would be the best way to store logs externally from Linux itself?

  • Just to make sure I don't over complicate things I want to make restate my question. When a user logs in and runs any commands, is that info logged? If so where? If any changes are made to the Linux server itself, is that logged and where? Lastly, if these items are logged, can I simply edit log file length in logrotate.d for example or do I need a special program added in to do all this? I can find a solution for moving logs off the VM if needed. – Sean Richards Feb 22 '15 at 7:37

The most practical way to do this is likely going to be with a third-party application like Opsmatic, though I'm admittedly unfamiliar with the particulars of SOX compliance gelling with SaaS services. I've used this and, though they have been having some growing pains, their product is really useful for the type of monitoring you're talking about.

(Also, an unsolicited word of advice: The point of these logs is record-keeping, sure, but tools like Opsmatic will also help with alerting. Whether your the official sysadmin or not, if somebody gets onto a server hosting financial data and starts sniffing around, you may be the person who gets stuck with the blame.)

  • Thanks for the suggestion but Opsmatic is more than what I need(we host our own servers internally). The top priority at the moment is logging and to log for 1 year for the aforementioned items. – Sean Richards Feb 22 '15 at 7:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.