Re: How can I get an alert if someone views or changes syslog.

From: bostontechgroup (support_at_bostontechgroup.com)
Date: 12/17/04

  • Next message: Bryan Olson: "Re: [Lit.] Buffer overruns" 
    Date: 17 Dec 2004 08:59:49 -0800

    Asides from tightenting permissions on critical files like this you
    could try using something like swatch. Swatch is a handy tool that
    monitors log files for keywords or triggers and alerts you via email or
    pager.

    Another technique commonly used is to centralize all of your syslogs to
    a central very tightly secured log server. This way as each one of
    your clients logs an event it sends it to the central log server which
    no one has access to. You could also keep a copy of the local syslogs
    on each client to compare in the event you feel you have been
    compromised.

    Hope that helps. 

    --
Boston Technology Group
http://www.bostontechgroup.com
  • Next message: Bryan Olson: "Re: [Lit.] Buffer overruns"