logging Defense

By default, at least on Ubuntu apache2 is set to rotate logs every 14 days.

It will rotate logs held here: /var/log/apache2/*.log

Using the rotate configuration, you can specify a value:

Text

Description automatically generated

You will need to check storage capacity if you are going to keep logs on box for a period. You may want to consider shipping these to a SIEM. However, for now let’s look at local storage.

Once you have made the configuration change there is no requirement to restart a service. Lograte runs using a cron job.

We can see the job listed under /etc/cron.daily/logrotate

Text

Description automatically generated

See nice and simple!

Just remember to check storage volumes:

Text

Description automatically generated with medium confidence

You don’t want to run out of storage and keeping logs on the box isn’t the best idea, if the server is owned the logs could be too.

Leave a Reply