Prove your retention is what you think it is
Task
Measure, for each log source in your lab, how far back you can actually answer a question -- and then break one source silently and see how long it takes you to notice.
Steps
- On the collector, list every log source currently writing, with the timestamp of its oldest and newest record. Write the table down.
- For each source, work out the effective retention: not the configured policy, the actual oldest record present.
- Compare that against a realistic question. "Did this account log in five weeks ago?" -- can you answer it from what is on disk?
- Now break one source deliberately: on the Windows VM, stop the forwarder service. Do not write down when.
- Go and do something else for twenty minutes. Come back and work out, from the collector alone, that a source has stopped. Time how long it takes you to spot it.
- Write the detection that would have told you: a rule that fires when a source that normally reports has not reported for N minutes.
Verify
for f in /var/log/collected/*; do printf "%s " "$f"; head -1 "$f" | cut -c1-15; done
find /var/log/collected -mmin -10 -type f | wc -l
find /var/log/collected -type f | wc -lThe first prints each source's oldest record, which is your real retention. The second and third are the health check: the count of sources that have written in the last ten minutes must equal the total. When you stopped the forwarder, the two numbers diverged -- and nothing else on the collector changed at all.
Notes
The second number being lower than the third is the single most useful health check in a SOC, and it is almost always missing. A source that stops reporting produces no alerts, no errors, and a dashboard that looks calmer than before.
Record your measured retention per source somewhere you will find it again. The incident response preparation lab asks for exactly this number.
This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.