Managing WAS Logs Healthily, Like Proper Diet and Exercise

WAS logs need to be managed consistently, like diet and exercise. Setting an appropriate log level and log format allows you to secure the information needed for security analysis and incident response, without using excessive storage space.

Error logs and access logs are key clues for identifying whether an attack occurred, what tools the attacker used, and where the access came from. That's why, rather than the minimum level needed for each WAS, you should first establish collection criteria suited to the nature of the service.

• IIS: Additionally collect items such as sc-bytes, cs-bytes, and protocol version, and set log rollover to daily.
• Apache HTTP Server: Use ErrorLog for the error log, choose a level between error and warn, and for the access log, combined or, when compiled from source, combinedio is recommended.
• Tomcat: In logging.properties, INFO or WARNING is recommended as the default level, and in server.xml's AccessLogValve, set the standard as pattern="combined".
• NGINX: Set error_log to error and access_log to combined as the baseline, adjusting the storage location as needed.
• Spring Boot: In application.properties or application.yml, set the default log level to WARN or ERROR, and directly specify the access log format via server.tomcat.accesslog.pattern.
• Node.js: Typically use winston to separate error logs from access logs, with error recommended as the default log level.

Permission settings also matter. Log directories and files should be accessible only to users who need them. On Windows, restrict permissions centered on a dedicated WAS account and group; on Linux, the principle is to keep log directories at 750 or below and log files at 640 or below.

Ultimately, the key is not to rely on default settings. Logging is not a feature that's already on by default—it's a setting that must be deliberately tuned for security and operations, and it's an item worth checking during system reviews, such as those done around year-end and New Year.