What is the best way to figure out what exactly needs to be logged for Network Devices, Databases and Wireless Networking Devices? I'm not an expert in this area but I need to figure out what data elements needs to be logged. Ideally, everything should be logged for meaningful security correlation but that's not possible at the moment as it becomes a Data Management issue. So I need to limit logs to what is required by PCI.

Example: How McAfee provides Windows server logging guidance.

1 Answer 1


The absolute minimum you should log is successful and unsuccessful authentication attempts, along with configuration changes (including account changes such as new account, changes of passwords, changes of privileges etc.) and then state changes (device downtime, reboots, etc.), and also software changes including updates and patches being applied.

Then all activity by authenticated accounts that have either administrator access, or otherwise privileges allowing for any security related configurations.

Remember however that the logs need to be protected from tampering where possible (best practice is to have a centralised logging system that requires collusion to have privileged access if possible).

At the end of the day your QSA will determine whether you are logging enough information to provide support for both active alerting on suspicious behaviour, non-repudiation, security process improvement and possible forensics or damage limitation, but this would seem a sensible minimum.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .