aegis-logging-monitoring

Scope & Objectives

Audit whether one running Linux host (or its config-as-code) produces, keeps, protects, and surfaces security telemetry. Eight domains, in priority order:

1. Capture & persistence — journald Storage= mode (volatile-only = logs die on reboot = finding), rsyslog presence and classic auth files (/var/log/auth.log Debian-family, /var/log/secure RHEL-family).
2. Rotation & headroom — logrotate coverage of key files, journald size caps, disk/inode headroom for /var/log.
3. Event coverage — the checklist of events that must be logged: auth, sudo, identity changes, cron edits, package ops, firewall drops, kernel, crash-loops, app-layer auth failures.
4. Kernel-depth telemetry — auditd installed, running, carrying a baseline ruleset (identity, sudoers, sshd_config, time-change), with rotation and space-survival policy.
5. Integrity monitoring — AIDE baseline + periodic check (or osquery), webroot watches, database-update discipline.
6. Off-host shipping — forwarding rules in rsyslog, journald→rsyslog chain, vendor agents (Datadog/Fluent Bit/Promtail) glob coverage; local-only logging = finding.
7. Retention & permissions — hot-retention floor, WORM/object-lock mention, auth-log ownership/modes.
8. Response wiring — minimum alert set landing OUT of band of the monitored host, plus an ordered incident-triage quickstart.

Out of scope (cross-references): firewall drop-logging rule design → FW; sshd/PAM/sudo policy content → BASE; certificate expiry mechanics → TLS; app-code log-injection flaws → INJECTION; secrets leaked INTO logs → HSECRET; patch level → PATCH; audit-rule authoring beyond the baseline set here stays in this module.

Operating rules: