Create a Logfile Policy

If you are in the position to make recommendations for best practices, you should recommend creating company policies for dealing with logfiles. Logfiles will protect you and your business, while providing support for your decisions as an administrator. Include in the policy:

• Requirements for and management of centralized logging Centralized logs are easier to use and protect critical data from being accidentally lost or purposefully deleted or altered .

• Provisions for logfile backup Logfiles are crucial company data that needs to be backed up and archived. If your backup jobs are large enough that you have defined groups, you should define a specific group that covers application and operating system logfiles.

• Protection of logfiles Operating system logfiles should have restricted access since they can sometimes include passwords or other sensitive information.

• Logfile retention period Archiving logfiles forever is not an unreasonable approach. A compressed logfile takes up much less space than an uncompressed one; there is no reason not to compress your offline storage.