Lesson 8 of 9 · 25m

Logs that outlive the attacker: remote syslog and auditd

Ship logs off-box with rsyslog, rotate sanely with logrotate, and watch high-value files with auditd.