Re: [logs] Log file relativity analysis

Previous message: Walters, Thomas B: "[logs] Business Case for log centralization"
Maybe in reply to: XiaoMin Zhao: "[logs] Log file relativity analysis"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

durnieat_private

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I just use Oracle to work out relativity (event correllation)...

I've got over 200 devices logging to my logging management software.  I'm writing a Java front end that allows me to pull what I need out of the DB and will parse it out via XML... I'll post the source to the list when I get it done...

Chris Kirschke
Security Analyst
Silicon Valley Bank

>hi,
>There is many  new log files in our network systems every day,i
>ncluding www logs,ids logs,firewall logs and OS's logs etc. The administrator must audit those log files with log analysis tools to check if their networks is intruded.But there is a few log tool to analyse the log relativity(or correlation).It is difficult for discovery the distributed attack. Can we discuss the log relativity analysis here?You also give the correlative title(or paper) link.I will apperiate anybody who join to discuss the problem.
>
>regards,
>Tony
>
>
>_______________________________________________
>LogAnalysis mailing list
>LogAnalysisat_private
>http://lists.shmoo.com/mailman/listinfo/loganalysis
>

-----BEGIN PGP SIGNATURE-----
Version: Hush 2.1
Note: This signature can be verified at https://www.hushtools.com

wlsEARECABsFAj13wegUHGR1cm5pZUBodXNobWFpbC5jb20ACgkQ3UH5NRolsbaUaACa
Au+Bc0uNps39ia75XeSpKp9pnsYAoIGiHVelpIGawob+GjkeotvUKIXi
=3Oh3
-----END PGP SIGNATURE-----

_______________________________________________
LogAnalysis mailing list
LogAnalysisat_private
http://lists.shmoo.com/mailman/listinfo/loganalysis