Re: Firewall Logging question?

["Gleb Paharenko" <gpaharenko () gmail com>]

Hi.

> Is it really necessary? Are just the "deny" logs critical?
> Say disk space is not in abundance.

It depends on your policy. From my past experience it is very useful
when you're performing
incident investigation. You should probably react on suspicious 'deny'
alarms as it can be caused by
network compromise attempts.

2008/5/20 Albert R. Campa <abcampa () gmail com>:
> Hi,
>
> I am wondering what your opinion is on Firewall logging for
> "Accept/Permit/Allow" rules?
>
> Is it really necessary? Are just the "deny" logs critical?
> Say disk space is not in abundance.
>
> Should you not log "accept/permit/allow" firewall rules, or log
> everything and have your retention reduced?
>
> What are advantages to logging "accept/permit/allow" rules in a firewall?
>
> Thank in advance.
>
> Albert



-- 
Best regards.
Gleb Pakharenko.
http://gpaharenko.livejournal.com