Logged

Using Trends In Logs To Define New Security Requirements For Internet Facing Hosts

admin — Thu, 11 Mar 2010 02:53:25 +0000

I have a few servers at a colocation datacenter for running a number of sites, including this one. I have written before about detecting brute force attacks in logs. I have been watching the attacks continue in my logs, and have noticed a few things: 1. The attacks, as before, are coming from many different sources, [...]

Post from: Logged - Log Management Blog

Using Trends In Logs To Define New Security Requirements For Internet Facing Hosts

Pot Of Syslog-NG Tricks Version 2

admin — Wed, 03 Mar 2010 03:04:19 +0000

Correcting bad or duplicate time and date stamps Trying to accept logs from applications or devices into syslog-ng, but end up seeing two date and time fields in the resulting log coming out of syslog-ng? This happens because syslog-ng is not able to understand the format that the date and time stamp arrive in. Here’s an [...]

Post from: Logged - Log Management Blog

Pot Of Syslog-NG Tricks Version 2

Designing A Log and Event Monitoring Program

admin — Tue, 23 Feb 2010 02:25:28 +0000

Ultimately, as with all IT security programs, log monitoring programs are designed to address risks to data confidentiality, integrity and availability. Risks come in many types: Hardware failure System compromise User error Rogue administrator An organization’s program around log & event monitoring needs to be based on the specific risks that exist in that organization. Consider two these two scenarios: Scenario [...]

Post from: Logged - Log Management Blog

Designing A Log and Event Monitoring Program

Running Syslog-NG on Windows

admin — Mon, 22 Feb 2010 01:43:09 +0000

This post describes running syslog-ng as a server on Windows. In another post, we describe how to send Windows Event Logs to syslog. There are many great commercial syslog servers for Windows. There are not many options for those looking for a free alternative. One option is Aonaware. Another option is to install syslog-ng through cygwin. [...]

Post from: Logged - Log Management Blog

Running Syslog-NG on Windows

Pot Of Syslog-NG Tricks Version 1

admin — Fri, 19 Feb 2010 21:24:18 +0000

Fixing Duplicate Date and/or Hostname Problems Some devices send syslog messages with improperly formatted headers, which can cause syslog-ng to append a new set of header information, meaning that the host name and/or date appear twice in the logs. A simple way to solve this is using a template: source s_net { udp();}; destination d_file { file(“/var/log/file.log” template(“$MSG\n”)); [...]

Post from: Logged - Log Management Blog

Pot Of Syslog-NG Tricks Version 1

Defining Log Management and Log Monitoring Objectives

admin — Fri, 12 Feb 2010 23:19:25 +0000

System logs are good for more purposes that many people realize. In this post, I’ll describe the four broad categories of log usage. Forensic Record Keeping Many organizations choose to archive log data for a period of time for future reference. Generally, the usefulness of keeping archived logs comes from the situation where a system problem is [...]

Post from: Logged - Log Management Blog

Defining Log Management and Log Monitoring Objectives

Configuring SUDO for Effective Activity Monitoring Via Syslog

mutex — Fri, 05 Feb 2010 22:26:43 +0000

I have discussed in previous posts the importance of administrators using SUDO to provide individual accountability. SUDO provides command-by-command accounting of actions performed by administrators, with logs sent as standard syslog events looking like this: Feb 4 19:23:23 bsd sudo: jerry : TTY=pts/0 ; PWD=/usr/home/jerry ; USER=root ; COMMAND=/bin/ps -x Feb 4 19:23:34 bsd sudo: jerry : [...]

Post from: Logged - Log Management Blog

Configuring SUDO for Effective Activity Monitoring Via Syslog

Building A Program To Manage And Monitor Administrators

admin — Sun, 24 Jan 2010 21:46:24 +0000

Monitoring the activities of privileged users or server administrators is becoming a common requirement in many organizations for a few reasons: Compliance with legal or regulatory requirements, such as PCI, HIPAA, etc Performing outsourcing services to clients who require controls to prevent the service provider’s employees from causing harm to the client. A recent experience where a trusted [...]

Post from: Logged - Log Management Blog

Building A Program To Manage And Monitor Administrators

Segregating Logs From Different Log Files On A Centralized Log Server Using Syslog-NG

admin — Sun, 23 Aug 2009 20:22:25 +0000

In this post, I will demonstrate a way to capture logs from a series of log files, and relay those logs to a central log server, where the logs will be separated into log files, as they existed on the original host. Reading from files Syslog-ng has the ability to pull log data from files, then treat [...]

Post from: Logged - Log Management Blog

Segregating Logs From Different Log Files On A Centralized Log Server Using Syslog-NG

Using Syslog Logs For Validation of Security Policy Compliance

admin — Fri, 07 Aug 2009 21:49:23 +0000

In a previous post, I wrote about the general use of syslog logs as a method of ensuring compliance with policy. This is a specific example of how one might use syslog to do that. As IT operations mature, particularly in regulated environments, it is not uncommon for an organization’s security policy to require controls on [...]

Post from: Logged - Log Management Blog

Using Syslog Logs For Validation of Security Policy Compliance