What server access and administrative actions should be logged?
Log enough context to investigate who accessed a system and which important actions occurred, while excluding secret values. Authentication logs, privilege changes and customer-panel activity can provide complementary evidence. No single log should be assumed to capture every administrative action.
Before you start
- The systems through which administrators connect and an approved log access and retention policy.
Instructions
1. Choose meaningful events
Include successful and failed sign-ins, privilege changes, account and key changes, sensitive configuration actions and token-management events where supported. Record the identity, target, result and timestamp. Source addresses provide context but do not uniquely identify a person when NAT, proxies or shared systems are involved.
2. Protect collection and access
Use consistent time synchronisation and restrict who can view or alter logs. Consider a protected external collector for critical events so loss or compromise of one host does not erase all evidence. Monitor collection failures and avoid logging passwords, session tokens or entire sensitive request bodies.
3. Test investigation usefulness
Perform an approved benign administrative action and confirm that the relevant records can be found and correlated. Verify that staff can distinguish a requested control-panel action from a completed server operation. Review retention with the service and data owners, and make selected redacted extracts available to support when needed.
Check the result
- A controlled access or administration event is attributable and traceable across the relevant systems.
- Logs remain available to authorised investigators without exposing secret values.
Troubleshooting
- The portal shows an action but the server state did not change
- Compare the request result, provider processing and final server state. An activity entry may record acceptance before the operation completes.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.