Logging

Auth, admin, backups, and mail answer who did what, when, from where. A log is a contemporaneous record — written at the time, not reconstructed later. Copy it off the host and time-sync the clocks. Logs that live only on the host they describe die with the host. Logs the attacker can delete are a diary, not evidence.

First principles

A screenshot of a console after the fact is a story. A log can be evidence because it was written at the time of the event.

Time is part of the record. If clocks disagree, you cannot order events across hosts. NTP (or equivalent) is not decoration. Put every system on a source you control or a public one you name, and alert when a clock walks.

If they can delete it, it is not evidence

Logs that live only on the host they describe die with the host. An attacker with admin on that host can empty the file. Ship copies off-box as they are written: another host, an object store the host role cannot delete, a SIEM whose admins are a different identity. Retention is a policy. Integrity is a different identity.

What an admin actually does

• Collect: authentication (including MFA and VPN), privileged use, backup and restore, mail gateway, DNS, firewall allows and denies at the edge, cloud audit logs.
• Ship off-host. The source host may keep a local tail. The copy you will trust in an incident is elsewhere.
• Sync time. Confirm it. A log line without a trustworthy timestamp is a rumour with a date stamp.
• Name an owner for the queue. Unread logs are storage. Detection is a person or a rule that reads them.