| Information stored in one location is vulnerable to accidental or intentional deletion or alteration. Sending log records to a log server is a form of “off-loading” and is a common practice since network elements usually have a limited amount of storage. This also prevents the log records from being lost if the logs stored locally are accidentally or intentionally deleted, altered, or corrupted.
Network elements such as firewalls and components with Access Control Lists must have the capability to support centralized logging. They must be configured to send log messages to centralized, redundant servers in real time. Joint Publication 1-02 defines “real time” as “Pertaining to the timeliness of data or information which has been delayed only by the time required for electronic communication. This implies that there are no noticeable delays.” In other words, the device must send the log records to the centralized, redundant servers at the same time it is writing them to the local storage.
In turn, the log servers must be backed up on a regular schedule at weekly intervals. This allows the records to be saved in case an investigation or audit is performed at a later date. |
