Background & Standards

• Logging and Audit Overview
• Specifications and Standards
• Archiving Secure Audit Files
• Programming syslog

Logging Infrastructure

• Centralized Logging
• syslog Replacements (UNIX)
• syslog Servers (non-UNIX)
• UNIX & related (routers, FWs) to syslog
• Windows to syslog
• Logfile Rotation Tools

Data Analysis

• Log Parsers (App Specific)
• Log Parsers (Generic)
• Regular Expressions
• Data Correlation
• Sample Log Files
• Intrusion Signatures
• Message Dictionaries
• Messages that Made Us Laugh

Resources

• Mailing Lists
• Research

Regular Expressions

• Apocalypse 5 - Regular Expressions by Larry Wall
• The Dark Side of Regular Expressions describes troubleshooting performance issues with regular expressions. The scenario is not syslog-related, but helpful nonetheless.
• Kernighan & Pike article in Dr. Dobbs’ Journal: requires payment, and I’m not sure about the value for money it provides (if you’ve read it and would like to send me your opinion, I’ll post it here).
• Mastering Regular Expressions: The O’Reilly book on regular expressions. Chapter 4, The Mechanics of Expression Processing is on-line.
• Stafford, Regular Expressions
• The Regex Coach — an interactive tool for Linux and Windows that allows users to tune and experiment with their regular expressions
• All My REGEXs Live in Texas Software tips from Splunk on regular expression tools, and examples of using regular expressions within Splunk.