1

What would be the downsides to either disabling or automatically deleting web server access logs that are older than 7-10 days?

I'd like to limit how long I store personally-identifiable data (IP address) for my visitors but would also like to strike a balance with regard to security.

Would I be losing anything important if I were to disable logs or just didn't notice something wrong with the site until after the logs had been deleted?

Improve this question

1 Answer 1

Reset to default
1

Disabling logs may deny you the ability to properly audit security events when they are noticed. If erasing IP addresses is a concern, there is an approach that will allow you to retain useful information without storing the actual IP address - tokenisation. You could convert the IP addresses to opaque hashes that allow you to track a source IP's activity in the logs without knowing the exact IP. If an IP is found to be behaving in a malicious way, you could then check recent logs/new connections for any IP address that hash to the same output. At the least, you will have a better chance of reconstructing what went on.

You may also wish to consider log aggregation solutions.

Improve this answer
3
  • yeah, this is my primary concern regarding limiting the use of logs. Would it make a difference if i use a web hosting provider instead of self-hosting? I imagine that disabling logs is less of an issue with hosting providers since they presumably have their own security measures.
    – DeveloperACE
    Dec 15, 2018 at 16:03
  • I should also probably add that my hosting provider doesn't allow much fine-grained control over logs so the best i could do is probably a cronjob if auto-deleting or disabling is not an option
    – DeveloperACE
    Dec 15, 2018 at 16:07
  • Even if these are only access logs and not application level logs, hosting providers may not be able to identify patterns of malicious use because the patterns of legitimate use may vary between different servers they host. I'd argue it's best to keep your own logs in so far as you can. Particularly if there are easily identifiable patterns for logs that contain source ip addresses, something as simple as a cron job that executes grep/sed commands on the log data to tokenize ip addresses before archiving the data might be a simple and effective solution.
    – Orphid
    Dec 22, 2018 at 6:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.