There are few important operational considerations when we are forwarding logs to a central logging server, here are some of the most important ones:
- Monitoring the logging status of all the sources: It is observed that specifically among hundreds of servers, if one server's log agent is not forwarding data related to audited records, then a predefined alert might not get generated in case of a suspicious event in the central log monitoring server related to specific activity.
- Ensure that the host server's clock is synced to a common time source: This part is also very important; otherwise, you might get inconsistent data related to the time of the events that have been generated. Make sure to have a common NTP ...