Central security logging - shipping logs to a SIEM

Local logs are useless if the attacker erases them. Central logging ships events off-host for retention, correlation, and investigation. This lesson covers the standard mechanisms.

Architecture

host                          central
  |
  |--- syslog/journald ------>  rsyslog / journald-remote
  |                                |
  |                                v
  |                              SIEM (Elastic, Splunk, etc.)
  |
  |--- audit.log ------------>  audisp-remote
  |
  |--- application logs ----->  filebeat / fluentd

journald forwarding

Send systemd journal to a remote:

# /etc/systemd/journal-upload.conf
[Upload]
URL=https://logs.example.com:19532
ServerKeyFile=/etc/ssl/journal-upload.pem
ServerCertificateFile=/etc/ssl/journal-upload.pem
TrustedCertificateFile=/etc/ssl/ca.pem

Enable:

sudo systemctl enable --now systemd-journal-upload.service

rsyslog forwarding

Traditional syslog:

# /etc/rsyslog.d/central.conf
*.* @@logs.example.com:514    # TCP
*.* @logs.example.com:514     # UDP

@ is UDP, @@ is TCP. Use TCP for reliability.

Reload:

sudo systemctl restart rsyslog

auditd remote logging

sudo apt install audispd-plugins

# /etc/audit/plugins.d/au-remote.conf
active = yes
direction = out
path = /sbin/audisp-remote
type = always
# /etc/audisp/audisp-remote.conf
remote_server = logs.example.com
port = 60
transport = tcp

Restart:

sudo systemctl restart auditd

What to ship

Always ship:

• SSH authentication events (login success and failure).
• sudo usage.
• PAM events.
• SELinux/AppArmor denials.
• Audit log events tagged with privileged keys.
• Kernel module loads.
• Service starts and stops (for incident context).

For high-volume events (e.g. network connections), consider sampling or filtering before shipping.

Retention

A central SIEM typically retains logs for 30-90 days for active search, and 1-7 years in cold storage for compliance. Plan capacity accordingly:

• 1 host generates ~10MB of audit log per day (varies).
• 1000 hosts: ~10GB/day, ~300GB/month.

Compliance

Many compliance regimes (PCI-DSS, HIPAA, SOX) require:

• Central log retention.
• Tamper-evident storage (write-once, signed).
• Time synchronisation across hosts.
• Documented log retention policy.

Central logging addresses most of these.

Knowledge check