For PCI compliance, does every request need to be logged regardless of how it affects system performance?

Question

Our cloud based service is currently undergoing changes with a view towards PCI compliance.

It is a high throughput service, and there are concerns that enabling the right amount of logging on our web server application will hinder performance of our system (What logs to retain for PCI-DSS? - Retain All The Logs). During performance testing there is a large performance deficit when logging is enabled. This post suggests what should be logged from a PCI perspective.

Disregarding PCI, from a security point if view I believe we will need to log every HTTP request like the httpd web server does by default because if there is any breach it would be difficult to perform forensic analysis on a system if logs are missing.

Am I correct in believing we will need to log every request and we will just need to take the hit and scale appropriately? Would it be acceptable to log to RAM disk and export the logs at regular intervals as a possible PCI complaint solution to the performance problem?

Answer 1

Let's try to tackle two problems at once. First of all yes you will take a performance hit, especially if you are logging onto the same machine. The idea is that you do not log everything locally but instead use an encrypted syslog connection (or similar) to log every request to a seperate logging server.

This will relieve the webserver from being busy with the logs. Normally this shouldn't be too difficult as normally you should have some sort of SIEM implemented (right?) where you can immediately log towards to. This will also allow you to write specific SIEM business rules for realtime allerting (or you can use the logs for statistics). Depending on how much money you have you can either go with Splunk or go for something more affordable like logstash with Kibana.

Log rotation and analysis in case of breach are also a lot easier when you've already imported logs into a similar database as they are extremely good at allowing fast log aggregation, correlation and searching. When you have a breach the last thing you want to be doing is spending tons of time importing logs into similar tools to analyze them.