Log Management · Topic 5 of 5
Centralized Logging
Learn centralized logging for a SOC: agent and agentless collection, syslog and Windows Event Forwarding, normalization, time sync and secure storage.
- 5 min
- Includes a diagram
- Centralized logging protects logs from local deletion and allows correlation across sources.
- Agents give richer data and buffering. Agentless needs no install but gives less detail.
- WEF forwards Windows events to a WEC using collector initiated or source initiated subscriptions.
What it is
Centralized logging sends logs from every host, device, application and cloud service to one protected platform, usually a log management system or a SIEM. Analysts then search and correlate everything in one place.
It solves the three weaknesses of local logs: attackers can wipe them, events cannot be correlated across systems, and each system must be checked one by one.
How it works
Planning
Before collecting anything, decide:
- Which sources matter: domain controllers, critical servers, firewalls, VPN, proxies, EDR, email, identity providers and cloud audit logs come first.
- Which events from each source: enough for the SOC's use cases, without debug noise.
- Retention: how long logs stay searchable and how long they are archived, based on policy and regulation.
- Capacity: events per second (EPS) and daily volume, which drive SIEM licensing and storage.
Collection methods
| Method | How it works | Notes |
|---|---|---|
| Agent based | A small program on the host reads logs and sends them | Rich data, buffering if the network fails, but agents must be deployed and maintained |
| Agentless | The collector pulls logs remotely (for example over WMI or an API) or the device pushes them | Nothing to install, but often less detail and more network load |
| Syslog | Devices and Linux hosts push messages to a syslog server | Standard for network devices, UDP 514 by default, TLS on 6514 |
| Windows Event Forwarding (WEF) | Windows hosts forward selected events to a Windows Event Collector (WEC) | Built into Windows, configured with subscriptions |
| API and cloud connectors | The SIEM reads logs from cloud services through their APIs | Used for SaaS and cloud audit logs |
Push means the source sends logs as they happen. Pull means the collector asks for them on a schedule.
On Linux, rsyslog can forward all messages with one line in its configuration. In rsyslog's traditional syntax, a single @ sends over UDP and @@ over TCP:
*.* @@logserver.example.com:514WEF subscriptions can be collector initiated (the collector contacts each listed source) or source initiated (sources, usually set by Group Policy, contact the collector). Source initiated scales better in large domains.
Processing
| Step | What happens |
|---|---|
| Parsing | Breaks the raw message into fields |
| Normalization | Maps fields to one schema, so "src", "SourceIP" and "c-ip" all become one source address field |
| Filtering | Drops events with no security value to save cost |
| Aggregation | Merges repeated identical events into one with a count |
| Enrichment | Adds context: asset owner, criticality, geolocation, threat intelligence matches |
| Correlation | Links events across sources to trigger alerts |
Time synchronization
Every source must use NTP against the same time servers. Store times in UTC, or keep the time zone with each event. Without consistent time, correlation rules miss sequences and timelines are wrong.
Protecting the central store
- Encrypt logs in transit (syslog over TLS, encrypted agent channels).
- Use role based access, so analysts can read but not delete logs.
- Hash or sign stored logs, or use write once (WORM) or immutable storage.
- Keep a separate admin account for the log platform, not domain admin.
- Alert when a source stops sending logs, since silence can mean tampering or failure.
Storage tiers
| Tier | Purpose |
|---|---|
| Hot | Recent data, fast search for daily triage |
| Warm | Older data, still searchable at lower cost |
| Cold or archive | Long retention for compliance and forensics, slower to restore |
A worked example
A company forwards only domain controller logs to its SIEM. During an incident the SOC cannot see which workstation ran a malicious PowerShell script, because workstation logs stayed local and the attacker cleared them.
The fix is to deploy Sysmon and WEF from all workstations, forward firewall and proxy logs over syslog with TLS, normalize all sources to one schema, sync every clock with NTP, and add a rule that alerts when any source goes silent.
How the exam asks about this
- "Which built in Windows feature sends selected events from many hosts to a collector?" → Windows Event Forwarding (WEF) to a Windows Event Collector.
- "Which processing step maps different field names for the same data into one schema?" → Normalization.
- "What should the SOC do when a critical log source stops sending events?" → Treat it as an alert and check for failure or tampering.
What to remember for the exam
- Centralized logging protects logs from local deletion and allows correlation across sources.
- Agents give richer data and buffering. Agentless needs no install but gives less detail.
- WEF forwards Windows events to a WEC using collector initiated or source initiated subscriptions.
- Normalize fields, enrich with context, and keep every clock on NTP.
- Protect the store with encryption, access control, integrity checks and alerts for silent sources.
Sending logs over plain UDP syslog gives no delivery guarantee and no encryption. For sensitive logs across untrusted networks, use TCP with TLS.
Common mistakes
Collecting everything without a plan. Volume drives cost and noise. Start from use cases and critical assets.
Forgetting to monitor the pipeline. A broken collector creates a blind spot that looks exactly like a quiet network.
Letting domain admins delete SIEM data. If the attacker gets domain admin, they get the logs too. Separate admin rights for the log platform.
Check yourself
What is the difference between push and pull collection?
With push, the source sends logs as they happen. With pull, the collector requests them on a schedule.
What does enrichment add to a log event?
Context such as asset owner, criticality, geolocation and threat intelligence matches, which speeds up triage.
Why store recent logs in a hot tier and older logs in an archive?
Hot storage gives fast search for daily work, while archive storage keeps long retention at low cost.
Topic 5 of 5 in Log Management
Test yourself on Log Management
The full EC-Council 312-39 question bank has 700 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.