Relatable recent thread https://news.ycombinator.com/item?id=44602532 https://news.ycombinator.com/item?id=44602532 "When root meets immutable: OpenBSD chflags

Relatable recent thread https://news.ycombinator.com/item?id=44602532 https://news.ycombinator.com/item?id=44602532 "When root meets immutable: OpenBSD chflags vs. log tampering" (153 points, 45 comments). Not to necessarily focus on the operating system used, but think of the attacker model and risk appetite of the organisation. What are the required integrity goals? What retention do you (legally) require? Who should be able to access those logs; on their own, or n-eye principle? Do such accesses need to be logged as well? What are the requirements from the users of the audit log? The things you'll need to log will become clear after answering such questions. How you structure them depends on the required access patterns. Tamper evidence can be achieved in many ways, but that depends on the integrity requirements; is an empty log line where one should have been enough "tamper evident"? Do you need some sort of verification mechanism that confirms the log lines you see were stored in that order? If your log only persists on the machine where it originated, does that satisfy integrity requirements?