RE: [logs] About Windows NT/2000 logs

From: Steve Wray (steve.wrayat_private)
Date: Tue Mar 05 2002 - 12:39:31 PST

Next message: Steve Wray: "RE: [logs] About Windows NT/2000 logs"

Previous message: Desai, Ashish: "RE: [logs] About Windows NT/2000 logs"
In reply to: dgillettat_private: "RE: [logs] About Windows NT/2000 logs"
Next in thread: Alexandre Dulaunoy: "Re: [logs] About Windows NT/2000 logs"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

> From: dgillettat_private [mailto:dgillettat_private]
> 
> On 4 Mar 2002, at 19:19, Steve Wray wrote:
> 
> > OMG, after checking, I find that these
> > log files arn't even text files!
> > 
> > How on earth is one supposed to analyse them?
> > (the provided applet barely counts for log
> > analysis... If you can't grep the logs they
> > arn't worth keeping).
> > 
> > Maybe theres a setting to make NT/2k/XP
> > log to text files?
> 
>   Their not being text files probably has something to do with the 
> wide availability of hacker tools called "text editors" that can be 
> used to arbitrarily change the contents of such files to cover an 

Oh of course! Security thru obscurity; the best sort!
;)

> intruder's tracks.  Text files are also often susceptible to 
> compression ratios of 3:1 or more, particularly if they contain 
> repetitive data.

I use logrotate with compression. Gzip does a great job.

 


---------------------------------------------------------------------
To unsubscribe, e-mail: loganalysis-unsubscribeat_private
For additional commands, e-mail: loganalysis-helpat_private

Next message: Steve Wray: "RE: [logs] About Windows NT/2000 logs"
Previous message: Desai, Ashish: "RE: [logs] About Windows NT/2000 logs"
In reply to: dgillettat_private: "RE: [logs] About Windows NT/2000 logs"
Next in thread: Alexandre Dulaunoy: "Re: [logs] About Windows NT/2000 logs"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Tue Mar 05 2002 - 12:54:12 PST