4 ms·
You may want to send your syslog to the remote server too. Like patio11 said, after the web server gets hacked, you cannot trust it anymore to do a legit git di
by solarexplorer 12y ago
You may want to send your syslog to the remote server too. Like patio11 said, after the web server gets hacked, you cannot trust it anymore to do a legit git diff or store the legit log files. If you have a remote syslog, you can at least do forensics. (Except if your log server got hacked too...)
- pjmlp 12y agoThe best way to prevent the log server from being hacked is to use multicast in the logs. Then you have a few log servers listening for those packets. Even if the server gets hacked, you will get other ones with the full, correct, log.
- acdha 12y ago… and make sure that those servers run different kernels, syslog implementations, etc. so they don't all get hit by the same exploit. Probably a good idea to make sure that at least one of them is on a read-only network port, too.