[logs] Re: Log integrity handling on central logsystem

From: Marcus J. Ranum (mjr@private)
Date: Tue Aug 22 2006 - 14:54:19 PDT


John H. Sawyer wrote:
>If you could afford two systems, have your one system accepting the logs
>and another system that has no IP sniffing the wire for the logs as they
>go by. Now you have two sources and can compare them later.

By the way, if anyone wants it:
http://www.ranum.com/security/computer_security/index.html
"plog" -- a promiscuous mode syslog collector. It pulls up
UDP syslog packets, rips the syslog data right out of them
and injects them up /dev/log.

On good hardware it may be more reliable than syslogd
because it bypasses UDP input queues.

mjr. 

_______________________________________________
LogAnalysis mailing list
LogAnalysis@private
http://lists.shmoo.com/mailman/listinfo/loganalysis



This archive was generated by hypermail 2.1.3 : Wed Aug 23 2006 - 12:39:31 PDT