Lion Cipher Lab
Check logrotate settings against a log retention requirement
- Cyber / Security Engineer
- Intermediate
- ~40 min
- Free · no account required
Why it matters
Requirements often say how long logs must be kept. PCI DSS 10.5.1 says 'retain audit log history for at least 12 months, with at least the most recent three months immediately available', and NIST SP 800-92 treats retention periods as a basic part of log management policy. On Linux, how long logs are actually kept is usually decided by a logrotate setting someone chose to stop the disk filling, not to meet a requirement. The two rarely match. 'weekly' with 'rotate 52' looks like a year but is 364 days. 'rotate 400' looks generous, but a 'maxage 90' further down cuts it to 90 days. A…
What you'll learn
- computing how long logrotate actually keeps history
- handling global defaults that stanzas inherit
- size-based rotation and the once-a-day run
- maxage silently capping a large rotate count
- why 52 weeks is not a year
- finding logs that no stanza covers
Steps in this lab
- Rotation is not retention: compute the retention
- The config and the requirements
- Write the retention checker
- Run it: five of seven fall short
- Retention also needs disk, integrity and a copy elsewhere