sysadmin, 15 years, mostly linux and network gear. i keep logs because i have been burned.
rfc3164 says 1024 and plenty of things still implement exactly that
rsyslog: global(maxMessageSize="64k") and it has to come before any input is defined or it is silently ignored. that last part catches everyone
also if you are on udp a 64k datagram is not making it anyway
reverse dns then forward dns on the result
dig -x 66.249.66.1 should give something under googlebot.com, and resolving that name should give the address back. fails either step, it is lying
user agent is a string the client picks, worth nothing on its own
agents, but only if you already have config management. if deploying an agent is a manual job on 200 boxes you will have 160 running agents in a year and no idea which 40
access point saying how many clients it has, on a timer. no value in an individual one
filter at the source, sfos lets you turn it off per log type rather than all or nothing
also check for the same user agent hitting a lot of client sites at once. that is how you find out you were part of a sweep rather than the target
seriously enough to get an answer that makes sense. there is no housekeeping procedure that requires wiping the security log, it rolls over on its own
the other cost nobody mentions is that when the normalisation is wrong you cannot tell, because the original line is not what you are looking at anymore. keep the raw
turn them all off. add them back one at a time when something bites you. you end up with about six and they are all good
it means the address is private, there is no country to report. rfc1918
on outbound your source is internal so srccountry is basically always Reserved. dstcountry is the one you want
the auditor is right and the storage guy is right, which is why this is annoying
classic syslog has no timezone in the timestamp at all. device in +0300 sends a bare time, receiver assumes its own zone, everything is three hours out forever
store utc, convert on display, and for anything that cannot send an offset write its zone down in the config so the parser can correct it
4662 if you care about AD object access, but be warned it is a firehose and mostly unreadable
health check endpoints alone were 40% of ours. one line in the nginx config
you mostly cannot. that is the point of udp
netstat -su on the receiver, receive buffer errors. rsyslog impstats shows queue discards. neither gives you a real number for what never arrived
Get-ScheduledTask | ? {$_.Principal.UserId -like '*Administrator*'} and go find it
...we were not logging denies. thanks, that is embarrassing but useful
whatever ships with the distro. the only thing that actually matters is whether you turned on disk queuing, and nobody does until the first time the network goes away for an hour
ossec if you want something that runs for five years and you forget about it. wazuh if you want a dashboard somebody will actually open
the ones that wont give you a number without a call are the expensive ones. that is the whole tell, you can skip the call
auditd is fine, you just have to accept that reading raw auditd output is not something a human should do. pipe it through something that turns it into sentences first
also write down who is going to run it day to day. that eliminates half the list on its own
if you already know wazuh why change