Logged » logging

Reading Logs From A File In Syslog-NG

admin — Sun, 25 Jul 2010 15:28:57 +0000

I had previously written a little snippet on how to pull logs in from a file, however there is a substantial amount more to consider when configuring syslog-ng to read from a file, so I have dedicated this post to reading logs from a text file. The basic structure for reading logs from a text [...]

Post from: Logged - Log Management Blog

Reading Logs From A File In Syslog-NG

Pot Of Syslog-NG Tricks Version 3

admin — Thu, 15 Apr 2010 17:55:18 +0000

Retaining the original hostname of the origin of syslog messages through a Syslog-NG relay In some environments, syslog messages are concentrated and relayed through an intermediate syslog server. One of the big deficiencies of the stock syslogd that comes with many Linux/UNIX operating systems is that they don’t provide the ability to keep the hostname [...]

Post from: Logged - Log Management Blog

Pot Of Syslog-NG Tricks Version 3

Log Analysis and Log Correlation Basics

admin — Mon, 15 Mar 2010 19:54:18 +0000

Log data can provide benefits beyond the obvious notification of system events and security happenings. Aggregated logs from a system or from multiple systems can provide a more complete picture of problems when those logs are correlated together. To any experienced administrator, this is obvious. Consider the following environment: In this scenario, the administrator is [...]

Post from: Logged - Log Management Blog

Log Analysis and Log Correlation Basics

Pot Of Syslog-NG Tricks Version 2

admin — Wed, 03 Mar 2010 03:04:19 +0000

Correcting bad or duplicate time and date stamps Trying to accept logs from applications or devices into syslog-ng, but end up seeing two date and time fields in the resulting log coming out of syslog-ng? This happens because syslog-ng is not able to understand the format that the date and time stamp arrive in. Here’s [...]

Post from: Logged - Log Management Blog

Pot Of Syslog-NG Tricks Version 2

Designing A Log and Event Monitoring Program

admin — Tue, 23 Feb 2010 02:25:28 +0000

Ultimately, as with all IT security programs, log monitoring programs are designed to address risks to data confidentiality, integrity and availability. Risks come in many types: Hardware failure System compromise User error Rogue administrator An organization’s program around log & event monitoring needs to be based on the specific risks that exist in that organization. [...]

Post from: Logged - Log Management Blog

Designing A Log and Event Monitoring Program

Running Syslog-NG on Windows

admin — Mon, 22 Feb 2010 01:43:09 +0000

This post describes running syslog-ng as a server on Windows. In another post, we describe how to send Windows Event Logs to syslog. There are many great commercial syslog servers for Windows. There are not many options for those looking for a free alternative. One option is Aonaware. Another option is to install syslog-ng through [...]

Post from: Logged - Log Management Blog

Running Syslog-NG on Windows

Pot Of Syslog-NG Tricks Version 1

admin — Fri, 19 Feb 2010 21:24:18 +0000

Fixing Duplicate Date and/or Hostname Problems Some devices send syslog messages with improperly formatted headers, which can cause syslog-ng to append a new set of header information, meaning that the host name and/or date appear twice in the logs. A simple way to solve this is using a template: source s_net { udp();}; destination d_file [...]

Post from: Logged - Log Management Blog

Pot Of Syslog-NG Tricks Version 1

Configuring SUDO for Effective Activity Monitoring Via Syslog

mutex — Fri, 05 Feb 2010 22:26:43 +0000

I have discussed in previous posts the importance of administrators using SUDO to provide individual accountability. SUDO provides command-by-command accounting of actions performed by administrators, with logs sent as standard syslog events looking like this: Feb 4 19:23:23 bsd sudo: jerry : TTY=pts/0 ; PWD=/usr/home/jerry ; USER=root ; COMMAND=/bin/ps -x Feb 4 19:23:34 bsd sudo: [...]

Post from: Logged - Log Management Blog

Configuring SUDO for Effective Activity Monitoring Via Syslog

Segregating Logs From Different Log Files On A Centralized Log Server Using Syslog-NG

admin — Sun, 23 Aug 2009 20:22:25 +0000

In this post, I will demonstrate a way to capture logs from a series of log files, and relay those logs to a central log server, where the logs will be separated into log files, as they existed on the original host. Reading from files Syslog-ng has the ability to pull log data from files, [...]

Post from: Logged - Log Management Blog

Segregating Logs From Different Log Files On A Centralized Log Server Using Syslog-NG

Configuring The Snare Windows Client And Syslog-NG To Work Together

admin — Wed, 13 May 2009 23:57:31 +0000

In a previous post, we looked at installing Snare to log Windows events to a syslog server. Here, we will configure syslog-ng to accept messages from Snare and implement a few simple customizations, including storing the logs in individual files. We will assume that Snare is operational for the purposes of this guide. Please see [...]

Post from: Logged - Log Management Blog

Configuring The Snare Windows Client And Syslog-NG To Work Together