Generally speaking, the overall goal is to provide centralised logging services for the purposes of operations, compliance and audit. All systems should send log messages to the central server, where the logs will be kept in original form for the required period of time and the logs will be availble available for event, incident and problem management purposes.
...
There are several considerations for creating a centralised logging solution.
- What devices , and operating systems will be sending logs.
- What applications will be sending logs.
- What protocol will be used to send log messages.
- What timezone are each of the devices sending logs in.
- What criticality of logs is required.
...