Question

Based on your professional and/or educational experience, how often do you believe system log files should be checked? How vigilant are you regarding regular checks of these files? When discussing, please also outline some of the reasons why an administrator might tend to ignore these files.

Answer 1

Based on my professional experience, system log files should be checked regularly, every day, or at least once in a week. It should be regularly checked to see if the syslog file is generating logs if the file size is not exceeding the limit, should monitor the file, and verify it is backing up automatically or to be done manually, or if required it should be seen the backed up log file can be restored and accessed fine.

I am vigilant enough to respond to any anomalies, log generation errors, suspicious activities, behavior, or data regarding regular checks of these files. I try to reviewing the logs regularly which helps to identify malicious attacks on our company's system. Also, log monitoring software can be used which takes care of the task using rules automating the review of these logs and only point out important events that might represent problems or threats. System logs would have to be checked as and when there are technical issues. These files could be monitored and checked once a week. It is recommended to be checked every day.

Log files are the records the Operating System (OS) stores for an administrator for keeping track and monitor important events about the server, kernel, services, and applications running on it. To me system log management, monitoring, or checking it is an integral part of my responsibility as an administrator. I would check this system log file to check information about device changes, device drivers, system changes, events, operations, etc. I would check these files for security incident investigations.

Some of the reasons why an administrator might tend to ignore these files are:
* This particular task of regular checks of system log files has to be done manually, hence an administrator might be lazy and would want to avoid carrying out this task and thus, ignore these files from checking.
* In case, he or she does not know how to interpret the data in the file.
* He/she might assume the systems would always work fine and there would not be any issues currently and even in future.
* In case, everything from logging, monitoring, and backing up of the system log file is automated, then the administrator would not check these files unless there is a security incident and the company demands require investigations to be conducted by the administrator.