Re: [logs] Log archival

From: Marcus J. Ranum (mjrat_private)
Date: Wed Dec 11 2002 - 12:25:31 PST

  • Next message: Marcus J. Ranum: "[logs] date/time formats..."

    >My current thoughts are :
    >        * they should be archived to tamper proof (write once) media, such as CD-
    >or DVD-R.
    
    
    Could anyone on the list comment about the feasibility/forensic
    value of storing logs on spinning media and just burning complete
    archives of checksums to CDs and storing the digital signatures
    away? Paul?
    
    It strikes me that a few hundred gigs of logs is about $255.00
    worth of storage. I have 2 of those in my home MP3 server. ;)
    But you can store a LOT of checksums on a CD-R. ;) Indeed, if
    you're using a CD-R that allows write-updates, you'd be able
    to incrementally add and I don't think it'd be arguable that
    you'd be able to erase 'em later.
    
    mjr. 
    ---
    Marcus J. Ranum				http://www.ranum.com
    Computer and Communications Security	mjrat_private
    
    _______________________________________________
    LogAnalysis mailing list
    LogAnalysisat_private
    http://lists.shmoo.com/mailman/listinfo/loganalysis
    



    This archive was generated by hypermail 2b30 : Wed Dec 11 2002 - 14:10:27 PST