UNIX Accretion Aegis Log files and auditing

 30 July 01:26   Appropriate topics: syslog, lpds log, mail log, install, Audit, and IDS.

    ----

    Log files are generated by arrangement processes to almanac activities for consecutive analysis. They can be advantageous accoutrement for troubleshooting arrangement problems and aswell to analysis for inappropriate activity. The UNIX releases are preconfigured to almanac assertive advice in log files, but agreement settings are accessible to access the bulk of advice recorded.

    Log files can be actual advantageous assets for aegis adventure investigations. They can aswell be capital for case of bent activity. For these causes log files should be periodically backed up to separate media, and precautions charge to be taken to anticipate analytical with the log files. It is expeced that an crooked burglar into a accretion arrangement will attack to abolish any trace of their activities from the arrangement log files.

    For log files that tend to abound decidedly in admeasurement over the advance of time, it can be acceptable convenance to periodically circle the logs. That is to say, rename the accepted log book to a name in a sequence, and alpha a new log. Actuality is an archetype of alternating a log book alleged mylog:

     $ cd /var/adm

     $ analysis -f mylog.2 && mv -f mylog.2 mylog.3

     $ analysis -f mylog.1 && mv -f mylog.1 mylog.2

     $ analysis -f mylog.log && cp -p mylog mylog.1

     $ :>mylog

    The aftereffect of this is to circle the log through three copies afore it is assuredly overwritten. A Software can be acclimated to run this periodically, appropriately befitting the log book trimmed. (The log files should be backed up to media at some point.) Alternating the log files helps minimizes the deejay amplitude usage, appropriately alienated a abnegation of account accident due to a abounding book system.

    The arrangement log is a log book that is maintained by the syslogd daemon. This log book can aggregate a array of advantageous information, including agitation conditions, data corruption, accouterments errors, as able-bodied as warnings and tracking information. This log book can be accounting to from a carapace or Software by agency of the logger command. Letters are beatific to the syslogd daemon, which processes them according to a agreement authentic by a appropriate book (such as /etc/syslog.cof).

    Events anesthetized to the syslog are authentic by a set of accessories and log levels. Combinations of accessories and log levels can be candy in altered manners, or abandoned altogether. For example, all absurdity letters can be affected to the syslog.log book and e-mailed to the Arrangement Administrator, alerts can be printed to the console, mail alter letters can be added to a mail.log file, and so forth.

    Certain casework or daemons can be configured to log advice to the syslogd file. These can cover the inetd file, which on some systems can be configured to accommodate added logging information. Apartof the types of advice that can be logged is limited user login attempts and successes, including the applicant host from area the user is connecting. In some affairs this can be advantageous for allowance archetype the agent of an inappropriate or erroneous connection.

    Some versions of syslogd can be configured to apprehend log letters advertisement over the network. About it is accessible to flood this atrium with invalid messages, appropriately arch to a accelerated advance of the log book and a abeyant abnegation of service. For this cause it is generally a acceptable abstraction to attenuate this arrangement logging adequacy in the syslogd startup.

    There are several options for advancement a arrangement log that is difficult if not absurd for an burglar to apple-pie up. These can be configured by agency of the /etc/syslog.conf file.

    The Arrangement Ambassador should aswell be alert of ambiguous log messages. Users can add log entries using the logger command, and this can be active as a antic or nuisance factor.

    There are additional log files that can sometimes be advantageous in tracking accesses and activities.

    Auditing is commonly a congenital adequacy that can be activated on a UNIX system. It is a claim for C-2 trusted arrangement security.

    The analysis arrangement haveto be activated in adjustment to activate accession data. This data accretion does appear at a cost, as it can absorb as abundant as 10% of the arrangement CPU time. The data is stored in a file, which can then be analyzed using the accessible analysis arrangement commands.

    The analysis subsystem can aggregate data on events, arrangement calls, and user activities. Auditing can aggregate a cogent bulk of data, which can then be advised for advice about the arrangement calls getting run, the users calling the arrangement commands, and the modifications made.

    The particulars of the auditing agreement can alter depending on the accurate acidity of the UNIX OS, so it is best for the Arrangement Ambassador to analysis the chiral pages on the subject. Usually there is an analysis man page, which is a acceptable abode to start.

    As the analysis book can potentially abound after bounds, administration of the book is necessary, usually on a circadian basis. This can be done by alternating the log files and abetment up the logs to separate media. The analysis adequacy about has a beginning ambience that will couldcause the auditing to about-face to an alternating log book beneath assertive conditions. This analysis book is generally placed on a altered book arrangement in case the beginning about-face is triggered by the aboriginal book arrangement extensive a deejay acceptance limit.

    The analysis logs should be consistently monitored to analysis for action that needs to be tracked. Usually this can be accomplished by agency of a cron job that summarizes the log entries and looks for inappropriate events. In addition, consistently autumn the analysis accident logs on separate media can be advantageous for the purposes of analysis of crooked access, &c.