Security Basics mailing list archives
RE: Integrating logs from PIX, IIS and WAS
From: "Brian Loe" <knobdy () stjoelive com>
Date: Thu, 27 Oct 2005 20:50:45 -0500
I'm currently building a syslog server for the purpose of discovering security issues, configuration issues and troubleshooting. I'm utilizing a couple of tools for this, to include syslog-ng, mysql, and phpMyAdmin. I'd put those in google and check out the several sites on how to put them together. Because I'm also running Cacti on this server, and after seeing the page given below, I'm thinking I might try using it to show a graphical version of the syslogs. Then again, it might just be as easy as counting errors for the same purpose. I've had a test run and it worked decently. As my knowledge of mysql and syslog-ng increases, it'll get even better. Hope this helps, and let me know what kind of progress you make!
-----Original Message----- From: phunked up! [mailto:phunkodelic () gmail com] Sent: Thursday, October 27, 2005 7:35 AM To: Luis Angel Fernandez Cc: security-basics () securityfocus com Subject: Re: Integrating logs from PIX, IIS and WAS Go to www.logparser.com. Use that with a back end database such as MySQL or micorosft Sql (express is free) which will allow you to do analysis of the logs. I am also doing the same sort of thing and am using the above mentioned tools. On 10/26/05, Luis Angel Fernandez <lafernandez () matchmind es> wrote:-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, I am investigating about tools for integrate (store andanalysis)logs from different souces (Cisco PIX, IIS, WAS app server,syslog).The goal is be able of follow up a the behavior of apossible intruderthrought a scenario based on that products. Which is yourmethod fordoing a forensic task like this? Which tools could help forthis task?Regards.
Current thread:
- Integrating logs from PIX, IIS and WAS Luis Angel Fernandez (Oct 26)
- Re: Integrating logs from PIX, IIS and WAS phunked up! (Oct 27)
- Re: Integrating logs from PIX, IIS and WAS Luis Fernandez (Oct 27)
- RE: Integrating logs from PIX, IIS and WAS Brian Loe (Oct 28)
- Re: Integrating logs from PIX, IIS and WAS Ivan . (Oct 27)
- <Possible follow-ups>
- RE: Integrating logs from PIX, IIS and WAS Andrew Williams (Oct 28)
- Re: Integrating logs from PIX, IIS and WAS phunked up! (Oct 28)
- Re: Integrating logs from PIX, IIS and WAS phunked up! (Oct 27)