Using logs for forensics after a data breach

08.11.2010

UDP syslog to send logs to central repository:

* Unreliable transport mechanism with no guarantee of delivery but no need to manage each local system's log storage directories.

* Little possibility for bad guys to manipulate logs as they are being sent in real-time.

* Centralization of all logs providing a unique window into separate sources of logs.

Dedicated agent to send logs to central repository: