Permissions. System logs should be 0640 (or tighter) and owned by root:adm (Debian) or root:root (RHEL). Grant read access with group membership (adm, systemd-journal) rather than loosening file modes.

Don't log secrets. Passwords, tokens, session cookies, full card numbers and personal data turn your log store into a liability. Scrub at the application, or at the shipper with a transform, before logs leave the host.

Time sync is mandatory. Correlating events across hosts is impossible without it. Run chronyd or systemd-timesyncd everywhere and check with chronyc tracking or timedatectl. Log in UTC or with explicit offsets.

Ship logs off the host. An attacker with root can edit local logs. Remote copies (ideally append-only or WORM storage) preserve evidence. journald's Forward Secure Sealing (journalctl --setup-keys, Seal=yes) can detect tampering of local journal files.

Retention. Decide it deliberately: what regulations or contracts apply, how far back incident response needs to look, and what it costs. A common split is short local retention (days to weeks) and longer central retention (months to years), with cold storage for compliance.

Disk safety. Put /var/log on its own filesystem on important servers so a log storm can't fill /. Set SystemKeepFree= for journald, maxsize in logrotate, queue.maxDiskSpace in rsyslog, and rate-limit firewall LOG rules.

Monitor the logging pipeline itself. Alert when a host stops sending logs. Silence is often the first symptom of a broken agent, a full disk, or a compromised host.