Mastering Linux Security and Hardening - Second Edition

Setting up a remote log server

So far, we've just been dealing with log files on a local machine. But instead of having to log into each individual machine to review log files, wouldn't it be nice to just have all of the log files from every machine on just one server? Well, you can do that. The best part is that it's easy.

But convenience isn't the only reason to collect log files on one central server. There's also the matter of log file security. If we leave all log files on each individual host, it's easier for network intruders to find the files and modify them to delete any messages about their nefarious activities. (That's easy to do since most log files are just plaintext files that can be edited in a normal text editor.)