Logging using Syslog

Logging is a key facet of managing any system, and central logging is almost universally recommended. Logging centrally allows you to combine the logs from several servers or services – for instance, your firewall, load balancer, and web server – into one file in chronological order. This can often speed up any troubleshooting or diagnosis as you see an even move from one platform to the next. From a security point of view, this is especially important in Incident Response (IR). In responding to an incident, you might see malware arrive in an email, then execute as a process, then move laterally (often called "east/west") to other workstation hosts, or move "north" toward your servers. Add to this that after regular (often hourly) updates, the current versions of your tools may very well be able to pick malware out of your logs that might have sailed by unnoticed yesterday.

Also, from a security point of view, logging to a central...