One truth we have seen across hundreds of deployments: log projects succeed or fail on operational discipline, not technology choice. The ten practices below are the minimum standard we have validated at every scale, from ISPs to hotels.
1. Coverage first: no source left unlogged
Start with an inventory: firewalls, switches, routers, AP/hotspot controllers, DHCP and DNS servers, hypervisors, critical applications. Every box doing NAT or DHCP must be on the list — in lawful requests, it is always the forgotten device that breaks the chain. For each source ask: "what do we lose without its logs?" If the answer is "the IP-to-user mapping", it is critical.
2. Don't leave logs on devices — stream them out instantly
On-device logs vanish on reboot, get overwritten when full, and become untrustworthy if the device is compromised. The rule is simple: a log should leave the device the second it is created. On the central side, old records must be archived before disk pressure deletes them.
3. Take transport seriously: TCP on the LAN, TLS on the WAN
UDP is light but lossy; a single congestion event drops exactly the records you will need most. Use TCP inside the LAN and always TLS between locations. If legacy devices force UDP, isolate them and watch their volume (see #5).
4. Synchronize clocks: no NTP, no correlation
If two devices disagree by 4 minutes, you cannot reconstruct an incident — "which happened first?" has no answer. Attach all sources to the same NTP hierarchy and set a clear timezone policy (recommendation: UTC on devices, local time in views). The central platform should record both source time and receive time.
5. Monitor silence: "no logs" is also an event
The most insidious failure is not the noisy one but the silent one: a reconfigured firewall can stop logging for months unnoticed. Define a minimum expected volume per source; any source silent for X minutes should raise an alert. This is the most common finding in compliance audits.
6. Alert sparingly: alerting on everything is alerting on nothing
A team receiving 400 notifications a day does not read the 401st. Use three alert tiers:
- Urgent (SMS/call): service outage, stamping failure, silent source, brute-force detection
- Important (email/webhook): threshold breaches, recurring errors
- Info (dashboard): everything else — in search and dashboards, not notifications
Deduplication (100 copies of the same alert = 1 notification) and maintenance windows are non-negotiable.
7. Tier your retention: hot short, cold long
Keeping every record instantly searchable for 2 years is needlessly expensive. The common correct pattern: the last 30–90 days in an indexed "hot" tier, the rest in compressed "cold" archive. Write down the cold-restore procedure and test it yearly.
8. Make integrity provable: stamp + verify
Storing is not enough; you must prove nothing changed. Digest daily files with SHA-256 and seal them with RFC 3161 qualified timestamps. Failed stamping must raise an alert — "we've been unstamped for three days" must never pass silently.
9. Log access to the logs
The log server is the most sensitive data store on your network: who searched what, when, and what they exported — all of it belongs in an audit trail. Apply role-based authorization (operator ≠ auditor ≠ admin) and 2FA where possible. From a privacy standpoint, this fulfills the "record access to personal data" obligation.
10. Run drills: audit day is not rehearsal day
At least once a year, time this scenario: "Who was using IP 185.x.x.x on March 14 last year at 02:30?" Target: a stamp-verified report within minutes. The drill exposes coverage gaps, archive access issues and procedural holes before a real request does.
The checklist
| # | Practice | Test question |
|---|---|---|
| 1 | Full coverage | Is every NAT/DHCP box centralized? |
| 2 | Instant centralization | Would a device reset lose records? |
| 3 | Secure transport | Is inter-site traffic on TLS? |
| 4 | NTP discipline | Is cross-source clock skew <1 s? |
| 5 | Silence alerts | How fast do you notice a silent device? |
| 6 | Tiered alerting | Is that 3 AM SMS truly urgent? |
| 7 | Tiered retention | Did you test restoring 2-year-old records? |
| 8 | Timestamping | Is yesterday's file stamped and verifiable? |
| 9 | Access auditing | Can you answer "who viewed the logs"? |
| 10 | Yearly drill | How many minutes to answer a sample request? |
Gaps on this list? Request a free assessment — let's score your current setup together.