In this lesson, you will learn how to transition from storing Pluggable Authentication Module (PAM) logs locally on individual servers to streaming them in real-time to a centralized, high-capacity log aggregator for long-term audit retention.
The Challenge of Local Logging
By default, PAM logs (such as authentication failures, SSH logins, and password changes) are written to /var/log/auth.log or handled by journald. While sufficient for a single machine, this approach fails in distributed environments. If an attacker compromises a host, they can simply delete or tamper with your local audit trail. Furthermore, searching through dozens of separate files to investigate a distributed brute-force attack is inefficient and prone to error.
Streaming with rsyslog
To scale your logging, we decouple the log generation from the storage. We use a log forwarder—typically rsyslog or fluentd—to pick up logs directly from the system facility or the journal and ship them to an external aggregator like ELK (Elasticsearch, Logstash, Kibana) or Splunk.
For example, to forward all authentication events to a remote server using rsyslog, you can create a configuration file at /etc/rsyslog.d/10-auth-forward.conf:
# Forward all auth facility messages to the central log server
auth,authpriv.* @central-log-server.yourdomain.com:514
Ensuring Integrity
When you move logs off-host, you aren't just gaining storage capacity; you are also creating a security boundary. By offloading these logs instantly, you ensure that even if the local host becomes compromised or experiences a hardware failure, the audit trail remains intact on your hardened, read-only aggregation server.
When configuring your aggregator, ensure you use TLS encryption for the transport layer (e.g., using @@ in rsyslog instead of @) to prevent logs from being intercepted in transit. Once the logs arrive at your central hub, you can implement lifecycle policies to archive data to cold storage, meeting your long-term compliance requirements without inflating your local disk usage.
Key Takeaway: Centralizing PAM logs by streaming them to an external aggregator is essential for preventing log tampering and simplifying cross-system security analysis in distributed Linux environments.