Sends the logs with facilities mail and local5 and priority critical to IP address 10.0.4.50 

Sends the logs with facility mail  and any priority and logs with facility local5 and priority critical to IP address 10.0.4.50

Sends the logs with facilities mail and local5 to IP address 10.0.4.50 using UDP.

Sends the logs with facilities mail and local5 to IP address 10.0.4.50 using TCP

 The usernames in plaintext.

The users on the machine with their passwords, all encrypted.

The passwords encrypted.

The usernames encrypted.

afterrotate ... endscript

prerotate ... endscript

postscript ... endrotate

postrotate ... endscript

To compress logs from remote endpoints before they touch the local storage drive.

To automatically organize and isolate incoming logs into client-specific directories without requiring manual configuration updates whenever new devices join the network.

To bypass host operating system file system permission checks when writing log data.

To prevent remote hosts from discovering the physical IP address of the central loghost.

 Keep only the last two rotated files.

Rotate logs twice per week.

Rotate the logs daily and keep only the last two rotated files.

Rotate logs every two weeks.

logaudit -q confidential.txt

ausearch -f "confidential.txt"

aureport --file -s confidential.txt

auditctl -s confidential.txt

Send logs that have a local scope, that is they only contain information of an event that occurred in a machine that is not linked to an external connection.

Identify the logs that are generated locally in the SIEM.

Classify the logs for different applications and store them in different files.

Identify the logs generated by local users.