Last updated · reviewed for accuracy
Logging & monitoring
Every control in this track can fail quietly. Logging is how you find out, ideally from a dashboard the morning after, not from a customer the month after. This lesson is the difference between having logs and using them.
Centralise or it did not happen
Logs scattered across devices are archaeology; logs shipped to one place are evidence. Centralised syslog collection means device compromise cannot erase its own trail, searches cross devices, and retention outlives any single box.
You met the plumbing in NTP & syslog: every switch, router and firewall ships events to a collector. The security payoff is subtle but decisive: an attacker who owns a device can wipe its local log, but the lines it already sent are out of reach. On Cisco gear it is one line: logging host 10.0.30.5.
Severities as a triage system
Syslog severity runs 0 (emergency) to 7 (debug): lower is worse. In practice: 0-2 pages a human immediately, 3-4 lands in the morning review, 5-6 feeds dashboards and baselines, 7 stays off outside active troubleshooting.
| Level | Name | Treat it as |
|---|---|---|
| 0–2 | Emergency / Alert / Critical | Wake someone up |
| 3–4 | Error / Warning | Review today |
| 5–6 | Notice / Informational | Baseline & dashboards |
| 7 | Debug | Only while actively troubleshooting |
The counterintuitive habit: severities 5–6 are where security lives. A successful login is Informational, and a successful login at 03:40 from a new country is an incident. Alarms find errors; review finds anomalies.
What to actually watch
A short list reviewed beats a long list ignored: authentication events (especially failures then success), configuration changes, firewall denies from inside outward, and new-device events on the network.
- Auth: repeated failures, logins at odd hours, first login from a new source.
- Change: every
configure terminalon network gear, correlate with your change tickets. - Denies outbound: an internal host hammering blocked destinations is how infections announce themselves.
- Presence: new MAC addresses in sensitive VLANs (your MAC lookup tool tells you the vendor).
Logs are only as good as their clocks
Correlating events across devices requires synchronized time. If the firewall says 09:14 and the switch says 09:17 for the same incident, reconstruction becomes guesswork. NTP on every device, same sources, checked: before you need it.
This is why NTP and syslog share a lesson: they are two halves of one capability, trustworthy history. The habit that completes it is a ten-minute daily skim of yesterday’s 0–4 events: boring almost every day, priceless on the day it is not.
This closes the loop
Prevention (filtering), containment (segmentation) and now detection. The exercises hub has drills for the whole Security track, and your streak is waiting.
Frequently asked questions
Why send logs to a central server instead of checking each device?
Because a compromised device cannot erase what it already shipped, searches cross devices, and retention is yours to control. Local-only logs vanish exactly when you need them most.
Which syslog severities should alert immediately?
0–2 pages a human; 3–4 is the daily review; 5–6 feeds dashboards, and anomaly hunting, since attacker activity often looks like “successful” events.
Why does NTP matter for security?
Incident timelines are built across devices; unsynchronized clocks turn them into guesswork. Time sync is the cheapest security control you will ever deploy: details in NTP & syslog.