CERT-In 180-Day Log Rule: How to Build a Compliant Log Server in India
Short answer: CERT-In's directions of 28 April 2022 require covered organisations to enable logs on all their ICT systems and keep them securely for a rolling 180 days, to sync system clocks to NIC or NPL time, and to report listed cyber incidents within 6 hours. Turn that into hardware with one formula: events per second times average event size times 86,400 seconds times 180 days, then add RAID overhead and headroom. A refurbished rack server with a mirrored system drive and a RAID 6 or RAID 10 data array handles this well for most small and mid-size organisations.
Key takeaways
- Retention: logs of all ICT systems, kept securely for a rolling 180 days, and handed to CERT-In when it asks or when you report an incident.
- Reporting: incidents listed in the directions' Annexure I must be reported within 6 hours of noticing them or being told about them.
- Clock sync: NTP from NIC or NPL, or a source that does not deviate from them.
- The rule does not name a SIEM product. On location, the directions text says logs are kept 'within the Indian jurisdiction', while CERT-In's FAQ says logs may be stored outside India if you can produce them to CERT-In in a reasonable time.
- This is general information, not legal advice. Confirm your own obligations with a qualified adviser.
This guide is for IT managers and business owners in India who are searching for CERT-In log retention, CERT-In 180 day log requirement, log server setup or SIEM vs syslog server. Every rule below is taken from CERT-In's own directions and FAQ, and every sizing number is either from a vendor's documentation or marked as our own arithmetic. We sell refurbished servers in India, so we explain where hardware matters and where it does not.
Who has to follow the CERT-In directions?
The directions apply to service providers, intermediaries, data centres, body corporate and government organisations. CERT-In's FAQ (Q25) points to the IT Act's definition of body corporate: any company, and it includes a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities. In plain terms, most businesses that run IT systems fall inside the wording. The FAQ also says the directions apply to any entity in the matter of reporting cyber incidents (Q26). Whether a specific rule applies to a specific small business is a legal question, so treat this as a map, not an opinion.
What do the CERT-In directions require from your servers?
| Rule | What the directions say | What it means for hardware and setup |
|---|---|---|
| Log retention | Enable logs of all ICT systems and maintain them securely for a rolling 180 days, and provide them to CERT-In with an incident report or when ordered | Central storage sized for 180 days, protected from deletion and disk failure |
| Incident reporting | Report incidents listed in Annexure I within 6 hours of noticing them or being brought to notice | You need a way to notice: monitoring, alerting and someone who reads the alerts |
| Clock sync | Connect to the NTP servers of NIC or NPL, or to servers traceable to them, to sync all ICT system clocks | One internal NTP source, and every device syncs to it |
| Point of contact | Designate a point of contact and send the details to CERT-In in the Annexure II format | No hardware impact, but plan who answers |
Annexure I lists 20 incident types, including unauthorised access of IT systems or data, attacks on servers such as database, mail and DNS, ransomware and other malicious code, data breach, data leak, website defacement and attacks on digital payment systems. CERT-In accepts reports by email at incident@cert-in.org.in and by phone on 1800-11-4949; check the CERT-In website for the current reporting method before you rely on these.
Which logs should you keep?
CERT-In's FAQ (Q37) says the logs depend on your sector and gives a list that is not exhaustive: firewall logs, intrusion prevention system logs, SIEM logs, web, database, mail, FTP and proxy server logs, event logs of critical systems, application logs, SSH logs and VPN logs. It also says that both successful and unsuccessful events should be recorded. For a typical office that means firewall and router logs, Windows and Linux server logs, directory and authentication logs, VPN and remote access logs, and the logs of business applications such as ERP, mail and the website. Our enterprise network security guide and Linux server hardening checklist cover how to switch logging on at the source.
How do you size a log server for 180 days?
The formula below is our own arithmetic. The inputs are yours to measure.
Storage per day = events per second x average event size x 86,400. Storage for 180 days = storage per day x 180. Then add RAID overhead and 20 to 30 percent headroom.
The table uses an example average event of 500 bytes, which is an assumption for illustration, not a measured figure. Compression will reduce the numbers, and by how much depends on the log type.
| Events per second (example) | Per day | 180 days, uncompressed |
|---|---|---|
| 100 | 4.3 GB | about 0.78 TB |
| 500 | 21.6 GB | about 3.9 TB |
| 2,000 | 86.4 GB | about 15.6 TB |
Do not guess your event rate. Run the collector for a week, read the real daily volume, and multiply from there. Plan for growth, because a new firewall, a new server or an attack can multiply the volume overnight.
RAID overhead. As arithmetic, eight 4 TB drives give about 24 TB of usable space in RAID 6 (two drives of parity) and about 16 TB in RAID 10 (mirrored pairs), before formatting. RAID 6 gives more space and survives two failed drives. RAID 10 writes faster and rebuilds faster. Our RAID controller guide explains the controller side.
What does a vendor say about log server hardware?
Wazuh, a free and open source security platform, publishes a quickstart table for a single host that runs the Wazuh server, indexer and dashboard together, sized for 90 days of queryable alert data:
| Wazuh agents | CPU | RAM | Storage (90 days) |
|---|---|---|---|
| 1 to 25 | 4 vCPU | 8 GiB | 50 GB |
| 26 to 50 | 8 vCPU | 8 GiB | 100 GB |
| 51 to 100 | 8 vCPU | 8 GiB | 200 GB |
Wazuh says this is usually enough for up to 100 endpoints and recommends a distributed, multi-node deployment for larger environments. Two cautions follow. This table covers 90 days of indexed alerts, not 180 days of every raw event. And Wazuh's archives, which store all events received, are disabled by default, so you must switch them on if you want a full raw record. Wazuh stores logs indefinitely when archives are on, compresses them daily and signs each compressed file with MD5, SHA1 and SHA256 checksums, which helps you show that a file has not changed.
Reference builds for 25, 100 and 500 endpoints
These are our own suggestions, built from the vendor table and the formula above, not CERT-In requirements. They leave headroom because logs grow.
| Size | Suggested build | Notes |
|---|---|---|
| Up to 25 endpoints | A 1U or 2U rack server, 16 to 32 GB RAM, two SSDs in a mirror for the system and indexes, four disks in RAID 10 or RAID 6 for archives | Comfortably above Wazuh's 4 vCPU and 8 GiB row; size archives from your measured daily volume |
| Up to 100 endpoints | A 2U rack server with 8 or more drive bays, 32 GB RAM or more, mirrored SSDs plus a RAID 6 array | Above Wazuh's 8 vCPU and 8 GiB row, with room to hold 180 days of data instead of 90 |
| Around 500 endpoints | Separate collector and analysis nodes, 64 GB RAM or more per analysis node, 8 to 12 drive bays for archive storage | Wazuh recommends a distributed deployment above 100 endpoints. Size storage from the formula |
Our storage price list shows storage options, and the NAS vs SAN vs DAS guide explains when a separate storage box is worth it.
Syslog, Wazuh or Graylog: which software?
| Option | What its documentation says | When it fits |
|---|---|---|
| rsyslog | A high-performance, modular logging framework, the default logging daemon on many Linux systems, that collects, transforms and delivers logs | A simple central collector to meet the retention duty; no built-in analysis dashboard |
| Wazuh | A free and open source platform that combines XDR and SIEM capabilities; quickstart sizing above | Small and mid-size teams that want detection and a dashboard without licence cost |
| Graylog | A SIEM and log analytics platform that centralises machine-generated data with search, alerting and dashboards | Teams that want search-led log analysis. Check Graylog's current editions and hardware guidance on its own site |
Whichever you choose, the retention duty stays the same, and the reporting duty needs someone to watch the alerts.
How do you sync clocks to NIC or NPL time?
CERT-In's FAQ (Q43) says to configure the NTP servers of NIC or NPL on your enterprise NTP server and let other devices sync to it. The servers it lists are samay1.nic.in and samay2.nic.in for NIC and time.nplindia.org for NPL. You do not have to switch systems to Indian Standard Time, because NTP provides UTC and the receiving host converts it; the FAQ asks you to record the time zone with the time. Organisations that span several countries may use another accurate source as long as it does not deviate from NPL and NIC. Accurate clocks matter because, as CERT-In explains, unsynchronised clocks make it very hard to rebuild the order of events in an incident. Our backup server guide covers a similar discipline for backups.
How do you make logs hard to tamper with?
CERT-In asks you to maintain logs securely. These steps are our advice, not a CERT-In list:
- Send logs off the source machine. An attacker who controls a server can edit its local logs, so forward them to the collector as they happen.
- Limit who can delete. Use a separate administrator account for the log server, and do not share it with the people whose activity the logs record.
- Keep integrity checks. Use checksums or signed archives so you can show that a file has not changed, as Wazuh's signed daily archives do.
- Keep a second copy. RAID protects against a disk failure, not against deletion or ransomware. Back up the log archive to a separate system. Read the backup and disaster recovery guide.
- Protect the room and the power. A log server on a desk under a fan is a weak link. See our small data centre setup guide.
Personal data in logs, such as user names and IP addresses, falls under privacy law as well. Our DPDP Act infrastructure guide covers that side.
Readiness checklist for the 6-hour report
- Logging is switched on for firewalls, servers, VPN, directory and key applications, and failed events are recorded as well as successful ones.
- A named point of contact for CERT-In is decided and registered in the Annexure II format.
- Someone owns alert review, with a rule for who decides that an event is a reportable incident.
- Clocks sync to NIC or NPL time, and the time zone is recorded.
- You can search 180 days of logs and export the relevant ones quickly.
- You tested restoring a log archive from backup.
- CERT-In's reporting email, phone number and format were checked on its website this month.
What to buy refurbished and what to buy new
A log server is a good fit for a refurbished enterprise server: it needs reliability, many drive bays and plenty of RAM, and it does not need the latest processor. Buy the server refurbished with a warranty and spend the money you save on disks, a backup target and a UPS. Buy new disks for the archive array if you want a fresh drive life, and keep a spare. Our refurbished server range includes tested rack servers, and the server AMC keeps the machine covered after the 1-year warranty ends. For cost-sensitive storage upgrades see the Dell server drive guide and the HP server drive guide.
Frequently asked questions
Does CERT-In require logs to be stored inside India?
The directions of 28 April 2022 say logs must be maintained securely for a rolling 180 days and 'within the Indian jurisdiction'. CERT-In's FAQ (Q35) adds that logs may be stored outside India as long as you can produce them to CERT-In in a reasonable time. Service providers offering services to users in India must keep logs and records of financial transactions in Indian jurisdiction (Q36). Because the two texts read differently, keeping the log server in India is the simplest way to stay clear of the question. Ask your legal adviser if you plan to store logs abroad.
How much storage do I need for 180 days of logs?
Multiply events per second by average event size by 86,400 seconds by 180 days, then add RAID overhead and 20 to 30 percent headroom. As an example, 500 events per second at an average of 500 bytes is about 21.6 GB a day and about 3.9 TB over 180 days before compression. Measure your real event rate for a week before you buy, because guessing is the main reason log servers fill up early.
Is syslog enough or do I need a SIEM?
The directions require you to enable logs of your ICT systems and keep them securely for 180 days. They do not name a SIEM product. A central syslog server can meet the retention part. A SIEM or log analysis tool helps with the other duty, noticing an incident so you can report it within 6 hours, because someone or something has to read the logs. Small teams often start with a central collector and add analysis on top.
Can a refurbished server be used for compliance logging?
Yes. The CERT-In directions set rules about logging, retention, clock sync and reporting, and they do not set a hardware condition such as new-only. What matters is that the server is reliable, the disks are protected by RAID, the data is backed up, and the clock stays correct. Serverwale refurbished servers go through a 72-point test and carry a 1-year warranty, and an AMC covers the years after that.
Which time server should I sync to for CERT-In?
CERT-In's FAQ lists samay1.nic.in and samay2.nic.in (National Informatics Centre) and time.nplindia.org (National Physical Laboratory). You can configure them on your enterprise NTP server, and the other devices then sync to that server. You do not have to set systems to Indian Standard Time. NTP gives UTC, and you should record the time zone with the timestamp.
What happens if a company does not comply?
CERT-In's directions say that failure to furnish information or non-compliance may invite punitive action under sub-section (7) of section 70B of the IT Act, 2000. CERT-In's FAQ (Q23) says this power will be exercised reasonably and on occasions when the non-compliance is deliberate. This guide is general information, not legal advice. Check your own obligations with a qualified adviser.
Ask for a log server sizing and quote
Tell us your endpoint count, the systems that produce logs and the retention you need. We will suggest a server and storage layout and send an itemised quote for a tested rack server with a 1-year warranty. Call or WhatsApp +91-87962-44410, or contact us.
Sources: CERT-In, Directions under sub-section (6) of section 70B of the IT Act, 2000 (28 April 2022) (NTP, 6-hour reporting, 180-day log retention, Annexure I and II, sub-section (7) of section 70B) and CERT-In, FAQs on the Cyber Security Directions (May 2022) (Q23, Q25, Q26, Q35, Q36, Q37, Q40 to Q43); Wazuh, Quickstart (hardware table) and Event logging (archives, compression, checksums); rsyslog documentation; Graylog, What is Graylog. Sizing figures, reference builds and tamper-resistance steps are Serverwale's own arithmetic and advice, not CERT-In or vendor statements. General information, not legal advice. Read on 29 October 2026.