Background & Standards

• Logging and Audit Overview
• Specifications and Standards
• Archiving Secure Audit Files
• Programming syslog

Logging Infrastructure

• Centralized Logging
• syslog Replacements (UNIX)
• syslog Servers (non-UNIX)
• UNIX & related (routers, FWs) to syslog
• Windows to syslog
• Logfile Rotation Tools

Data Analysis

• Log Parsers (App Specific)
• Log Parsers (Generic)
• Regular Expressions
• Data Correlation
• Sample Log Files
• Intrusion Signatures
• Message Dictionaries
• Messages that Made Us Laugh

Resources

• Mailing Lists
• Research

Programming syslog

• Date and Time on the Internet: Timestamps
• Implementation of the ISO 8601 Standard Around The World
• ISO 8601 Date/Time Representations
• A summary of the International Standard Date and Time Notation
• A GPL’ed library for RFC 3195 syslog
• Java
  • protomatter — an open source collection of Java classes that includes a robust syslog implementation.
  • protomatter syslog reference for programmers
• Robust Event Logging with syslog (despite the generic title, this article documents how to implement syslog auditing into Java code)
• Logging services project of the Apache Software Foundation: cross language logging services for application debugging and auditing in a Web server environment
• Microsoft — This commercial product allows Microsoft Active Server Pages and Windows Scripting Host to write to the Windows Event Log or UNIX syslog. Any COM-enabled programming language is supported.
• Perl
• PHP
• Python
• syslog wrapper
• TCL
• Create Syslog-ng Rules Use syslog rules to send data to a log analysis application, in this case, Splunk.