Background & Standards

• Logging and Audit Overview
• Specifications and Standards
• Archiving Secure Audit Files
• Programming syslog

Logging Infrastructure

• Centralized Logging
• syslog Replacements (UNIX)
• syslog Servers (non-UNIX)
• UNIX & related (routers, FWs) to syslog
• Windows to syslog
• Logfile Rotation Tools

Data Analysis

• Log Parsers (App Specific)
• Log Parsers (Generic)
• Regular Expressions
• Data Correlation
• Sample Log Files
• Intrusion Signatures
• Message Dictionaries
• Messages that Made Us Laugh

Resources

• Mailing Lists
• Research

Logfile Rotation Tools

• Bill Pennington’s Logfile Rotation Script
• LogController: A logfile size management tool. Configuration options include logfiles to monitor, maximum allowable size, and whether old files should be compressed and stored, or erased.
• Logfile::Rotate
• logrotate
  • Using logrotate more effectively
• newsyslog — Russ Allbery’s version
• newsyslog — Portable to any version of UNIX, this is a highly enhanced version of Ted Ts’o’s original log rotation program. Contact Greg Woods for more information.
  • Using newsyslog to rotate files containing logging messages on systems running Solaris 2.x
• System Log Rotation Service (SLRS): a Solaris tool that rotates syslog files as well as other Solaris-specific system logs. Contact James Finegan for information.
• spinlogs: A portable script similar to BSD’s newsyslog.
• Trimlog: A utility that prevents logfiles from growing without bounds. Configuration options include files to monitor, mechanism for trimming, and amount by which to trim.
• watchlog: A daemon that rotates backlogs daily, weekly, monthly or when a maximum file size is reached. It will wake up once or more a day and check if any logs need processing.
• Bzip2: A fast high-compression tool - useful for large log files.