| 5.3 |  | Monitoring with Logging and Syslog |
| 5.3.1 |  | The value of logging |

| After the router is configured and initialized, the administrator enables the logging and system log capabilities of a router. Logging offers several benefits. The administrator uses information in a log to determine whether the router is working properly or whether it has been compromised. In some cases, logging can show what types of probes or attacks are being attempted against the router or the protected network.

Configuring logging on the router should be done carefully. The router logs should be sent to a designated log host . A log host is a dedicated computer whose only job is to store logs. The log host should be connected to a trusted or protected network, or an isolated and dedicated router interface. Protect the log host by removing all unnecessary services and accounts. Set the level of logging on the router to one that meets the needs of the security policy, and expect to modify the log settings as the network evolves. The logging level may need to be modified based on how much of the log information is useful. The following two areas should be logged:

1. Matches to filter rules that deny access
2. Changes to the router configuration

The most important thing to remember about logging is that logs must be reviewed regularly. Periodic checks of the logs will provide administrators with the normal behavior of the network. A sound understanding of normal operation and its reflection in the logs will help identify abnormal or attack conditions.

Accurate timestamps are important to logging. All routers are capable of maintaining their own time-of-day, but this is usually not sufficient. Instead, the router should be directed to at least two different reliable timeservers to ensure accuracy and availability of time information. Also, direct the logging host to the reliable timeservers and include a timestamp in each log message. This will allow the administrator to trace network attacks more credibly. Finally, consider sending the logs to write-once media or to a dedicated printer to deal with worst-case scenarios such as compromise of the log host.