What Is Log Management?
Key takeaways
- CERT-In expects incident logs to be retained for 180 days, which is far longer than the default rotation on most appliances and laptops.
- Logs stored on the machine that produced them are not evidence, because an attacker with administrative access usually deletes them first.
- Clock synchronisation across servers, firewalls and endpoints is what makes a timeline usable during an investigation.
- The International Standard on Logging and the CERT-In 2022 directions both push towards central, tamper-resistant log storage.
- Alerting on a small set of real events is what makes log management affordable for a business without a security operations team.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What does log management have to do with CERT-In?
Two things, and both are auditable. CERT-In's 2022 directions require that logs of all ICT systems be maintained for a rolling period of 180 days within the country, and that they be provided to law enforcement when a breach is reported within the prescribed timelines. The reporting obligation itself is the 6-hour rule: report incidents to CERT-In within six hours of noticing or being brought to notice. Logging is what makes that six-hour clock defensible, because it establishes when you actually knew. If you cannot show a timeline, the argument about when you were informed becomes a matter of argument rather than record, which is exactly where an organisation wants to be.
What should I log, and where should it live?
Log the security-relevant events on every system that matters: authentication success and failure, privilege escalation, configuration changes to network and security devices, malware detections, email and web filtering decisions, VPN and remote access sessions, and of course the audit trail of your key applications. Collect them centrally, to a log server that the monitored systems cannot write to and cannot delete from, with write-once retention for the most sensitive categories. A small Indian business can do this with a virtual machine and a well-known collector rather than an expensive appliance, but the design rule is the same: separate the collector from the monitored system and keep it somewhere the attacker will not reach first.
How do I get value from logs without a security team?
You cannot read every line, so decide in advance what you want to be told about. Start with a short list of high-signal conditions: a spike in failed logins for one account, a login from an unusual country, a new administrator account, a firewall rule change, a large data download, or an endpoint losing its agent. Route those to email or chat, and put a human in charge of one daily summary. Review the rest monthly, and treat the alerts as data: if an alert fires every week, it is a rule needing tuning, not a problem to ignore. Over time this becomes the early warning that separates a contained intrusion from a breach.
| Log category | Typical source | Retention |
|---|---|---|
| Authentication and access | Servers, applications, endpoints | 180 days, longer for financial systems |
| Firewall and network device changes | Firewalls, routers, switches | 180 days |
| VPN and remote access | VPN concentrators | 180 days |
| Email and web filtering | Gateway or proxy | 180 days |
| Endpoint detection events | Managed endpoints | 180 days |
| Central log store | Collector and its own access logs | Retained and tamper-evident |
| Application audit trail | Finance, HR and customer systems | Per statutory and contractual need |
What are the frequently asked questions?
Get a straight answer on this
Tell us how many servers, endpoints and network devices you run, and we will design a logging and retention baseline that meets the 180-day expectation.
Send us the details See pricing