Re: [logs] Update/copy logs to logserver (not via syslog)

From: Sweth Chandramouli (loganalysisat_private)
Date: Mon Feb 18 2002 - 11:49:53 PST

  • Next message: mikemat_private: "Re: [logs] Update/copy logs to logserver (not via syslog)"

    On Mon, Feb 18, 2002 at 08:26:17PM +0200, Radek Spacil wrote:
    > Do you have any (better) ideas how to do this?
    	Use timestamp-based names.  If you are using a scripted
    file copy, where you can specify the destination name, then this is
    trivial; you should be doing something like this to add in hostnames
    anyway if you are dealing with multiple machines.  If you are just
    doing straight mirroring, you might be able to set up a post-processing
    directive in the mirroring software; otherwise, have a cron job that
    runs at some reasonable offset from the sync=ing process, which looks
    at the ctime of each file and renames it based on that.
    
    > Another question is about ssh transfer. How to automate upload (rsync
    > or scp) without necessity of typing in passphrase - is ssh key without
    > passphrase OK?
    	Assuming you are talking about security, then probably
    yes, so long as you set things up correctly--remove all extraneous
    permissions, etc., and implement a "pull" mechanism where the log
    server grabs the files from the other machines, rather than where they
    push them to the log server.  (If the other machines can push files to
    the log server using keys, then an attacker who compromises one of them
    can push a sanitized version of a logfile to the log server and
    overwrite the one that contained evidence of his misdeeds; assuming a
    good file naming scheme were used as I suggested above, this wouldn't
    be an issue with a pull mechanism, as the destination file name would
    be generated by the log server itself.)
    
    	-- Sweth.
    
    -- 
    Sweth Chandramouli ; <svcat_private>
    President, Idiopathic Systems Consulting
    
    ---------------------------------------------------------------------
    To unsubscribe, e-mail: loganalysis-unsubscribeat_private
    For additional commands, e-mail: loganalysis-helpat_private
    



    This archive was generated by hypermail 2b30 : Mon Feb 18 2002 - 12:44:31 PST