[logs] Re: Few questions on log analysis

anton@private

Hello Kai and all,

> Do you know any resource where log-entries are described and/or
> classified?
There is really nothing of exactly that type of resource. Just look
thru the list archives; some pointers off the top of my head:
1. http://www.loganalysis.org
2. http://www.ossec.net/wiki/index.php/Log_Samples
3. SANS reading room
4. Tina Bird Syslog Attack Signatures (google for it; I saw it somewhere)

> scientific papers. The books I found (e.g. Babbin et al: Security Log
> Management) weren't very useful. Thus I contacting you to get some
Yeah, this book is genuinely bad; one of the few books on security
that I found truly useless for just about any purpose, apart from
removing some "extraneous" trees from the surface of the planet.

Best,
-- 
Anton Chuvakin, Ph.D., GCIA, GCIH, GCFA
     http://www.chuvakin.org
 http://chuvakin.blogspot.com
http://www.securitywarrior.com
_______________________________________________
LogAnalysis mailing list
LogAnalysis@private
http://lists.shmoo.com/mailman/listinfo/loganalysis