Mastering Linux Security and Hardening - Second Edition

Logging and Log Security

System logs are an important part of every IT administrator's life. They can tell you how well your system is performing, how to troubleshoot problems, and what the users—both authorized and unauthorized—are doing on the system. 

In this chapter, I'll give you a brief tour of the Linux logging systems, and then show you a cool trick to help make your log reviews easier. Then, I'll show you how to set up a remote logging server, complete with Transport Layer Security (TLS)-encrypted connections to the clients. 

The topics that we will be covering are as follows:

• Understanding the Linux system log files
• Understanding rsyslog
• Understanding journald
• Making things easier with Logwatch
• Setting up a remote log server