Log Server vs Auditing server

mp3markel

I'm trying to make my organization CJIS compliant and in the security policy they specify that logs must be sent to an auditing server. I just wanted to verify, is an auditing server the same as a log server? Thank you! -Mark

vasyvasy

Yes, more or less "log server" is an "auditing server"
Maybe the auditing server can present reports more beautifully, correlate more, or the archived logs are kept for a longer period of time...

But in essence, they both centralize logs from equipments and present a unified interface for events

powmia

No they are not the same, and the terminology needs to be more specific.

Audit logs, are the specific logs that pertain to Authentication, Authorization, and Accounting (anything login and permissions related). So you could have a log server that sends anything AAA related to an audit server. An auditING server implies that the server is performing actual audits itself. This would be an application that goes out and audits something specific... could be auditing endpoint/mobile device compliance, auditing server configurations etc.

You need to ensure you interpret the policy correctly, then you will know what it is that you need.