Re: periodic security run output gives false positives after 1 year
- From: Roger Marquis <marquis@xxxxxxxxx>
- Date: Fri, 17 Feb 2012 07:04:50 -0800 (PST)
Sergey Kandaurov wrote:
In IETF this RFC is marked obsolete and replaced with RFC 5424 with
different timestamp format in ISO 8601 form. FreeBSD doesn't implement
5424 yet. Almost complete implementation was done in NetBSD in that
regard in 2008. NetBSD before RFC 5424 changes has had pretty similar
syslogd source, so if one could analyze and port that changes to FreeBSD,
that would be pretty nice.
Problem with that would be backwards compatibility, and it's not IMO
worth breaking everyone's syslog parsing scripts to fix an issue that
really isn't due to the date format as much as it is to log rotation.
That's not to say that security scripts don't need to parse archived
logs, just that they should perhaps check the date stamp of the archive
files before parsing.
Have to admit we don't use FreeBSD (or any other OS's) log rotation or
log-related periodic scripts. Would love to submit replacements though.
Our logic is a bit different:
* rotating current log files, to /var/log/$log.$i only when they grow
larger than 100MB,
* checking log file size hourly,
* rotating all logs regardless of size only at the end of the month, to
a compressed file with the date stamp as part of the filename,
* maintaining monthly archived log files in a dedicated subdirectory
(/var/log/logarchive),
* writing each syslog facility to its own file (kern.log, local1.log,
...).
It is unfortunate that syslog is such a neglected and unoptimized aspect
of nearly all Unix and Linux default installs but SA's don't have to
restrict their systems to those defaults.
Roger Marquis
_______________________________________________
freebsd-security@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@xxxxxxxxxxx"
- Follow-Ups:
- Re: periodic security run output gives false positives after 1 year
- From: Sergey Kandaurov
- Re: periodic security run output gives false positives after 1 year
- From: Chuck Swiger
- Re: periodic security run output gives false positives after 1 year
- Prev by Date: Re: periodic security run output gives false positives after 1 year
- Next by Date: Re: periodic security run output gives false positives after 1 year
- Previous by thread: Re: periodic security run output gives false positives after 1 year
- Next by thread: Re: periodic security run output gives false positives after 1 year
- Index(es):
Relevant Pages
|
