>>arent sent instantly so an attacker could intercept or alter them With Reliable Event Logging Protocol [0], interception is somewhat mitigated. You can confi

>>arent sent instantly so an attacker could intercept or alter them With Reliable Event Logging Protocol [0], interception is somewhat mitigated. You can configure and white-list certificates on the client and server so that even if a network attacker inserts a syslog relay with a certificate that's signed but isn't the one expected, you can't intercept the messages. Though, if you have that much control of the network, you can just drop syslog packets entirely. Having a dedicated management NIC and network helps mitigate that. And I think there's a big difference between 10 seconds, and any delay inherent in to external syslogging. 10 seconds is enough time for an automated exploit to penetrate multiple layers of the security onion, but external logging should be able to squeak out a few messages between pwnage and syslog clobbering in the same situation (YMMV). [0] http://www.rsyslog.com/doc/relp.html http://www.rsyslog.com/doc/relp.html