4 ms·
> There's really not a reason to ship or index logs. Proper Information Security policy is one very good reason. If a box is compromised, you don't want the lo
by Narkov 6y ago
> There's really not a reason to ship or index logs.
Proper Information Security policy is one very good reason. If a box is compromised, you don't want the logs being tampered with.
You ship the logs to a central, dedicated server so that a clear audit trail can be established.
- jdxcode 6y agoI imagine basically any form of compliance would require centralizing logs in some form
- f0rfun 6y agoand for audit. Audit/Compliance is one of the worst yet valid reasons to introduce complexity, redundancy and all sorts of costs into projects. It's also why some people earn a living out of it purely.
- tyldum 6y agoAuthentication, authorization and access logs typically. Generic application logs can often be treated differently.
- nurettin 6y agoShipping software logs is just useless bureaucracy. Don't confuse it with shipping firewall/ssh/rdp logs which is an absolute must for telling how/when you were pwned. Hacker will just disable app/db logs, update their user as admin, dump the db and proceed with the cryptofuckery.
- throwawayinfo 6y agoEh? In my experience logs are some of the most valuable data produced by software. Debugging, experiments, software quality, auth trails, analytics, customer support, privacy, security, audit/compliance and abuse are all seriously useful applications for logs. Throwing them away is like dumping gold.
- nurettin 6y agoYes, nobody said throw away application logs. That's dumb.