The logs you’ll wish you had
When something goes wrong, the first question is “what happened?”. Keep these logs before you need them.
Every incident starts with the same question: what happened, and since when? Without logs, the honest answer is “we don’t know”, and that’s the worst answer to give a client.
Keep at least these:
- Logins: success and failure, with IP and time, for email, VPN, admin panels and servers.
- Admin actions: who created users, changed permissions, deleted data.
- Web server and firewall logs for anything facing the internet.
- Cloud audit logs. Most providers have them; some are off by default.
Three rules:
- Send them somewhere else. An attacker on the server can delete local logs.
- Keep them long enough. Break-ins are often found months later. 90 days is a minimum; a year is better.
- Sync the clocks. Logs with wrong times can’t be matched up.
You don’t have to read them every day. Just alert on a few things: many failed logins, a new admin, logins from a new country.