3 ms·
It's absolutely not enough for APT investigation. Average attacks lengths are in months, infections sometimes span multiple years. Especially since we're talkin
by msm_ 4y ago
It's absolutely not enough for APT investigation. Average attacks lengths are in months, infections sometimes span multiple years. Especially since we're talking about a backdoor (ransomware operators tend to move more quickly)
- Dylan16807 4y agoIt's not enough for that, but that bar is too high. Unless the logs are very small, you should not be keeping years of them. I still say 20MB is enough for a desktop.
- gerdesj 4y agoDepends on the desktop. Mine does quite a lot of stuff. /var/log is 8.3Gb and the journal is probably a monster. Your use case is probably different to mine - I'm a security officer for my firm.