Background & Standards

• Logging and Audit Overview
• Specifications and Standards
• Archiving Secure Audit Files
• Programming syslog

Logging Infrastructure

• Centralized Logging
• syslog Replacements (UNIX)
• syslog Servers (non-UNIX)
• UNIX & related (routers, FWs) to syslog
• Windows to syslog
• Logfile Rotation Tools

Data Analysis

• Log Parsers (App Specific)
• Log Parsers (Generic)
• Regular Expressions
• Data Correlation
• Sample Log Files
• Intrusion Signatures
• Message Dictionaries
• Messages that Made Us Laugh

Resources

• Mailing Lists
• Research

Sample Log Files

Operating Systems

• OpenBSD 3.1
  • syslog system boot record
  • wtmp records

Stand-alone Devices

• Cyberguard Firewall
  • security logs (proprietary format)

• Netscreen Firewall
• operating logs (proprietary format)

• Sidewinder Firewall
  • operating logs (proprietary format)

Applications

• Apache httpd
  • access_log
  • error_log
• tcpdump
  • Capture of some fragmentary packets

Tina and Marcus would like to thank the following for contributing logs:

Devdas Bhagat, Anton Chuvakin, Jeff Falgout, Kevin Gagel, Stu Green,
Adrian Grigorof, John Kristoff, Daniele Muscetta, Mikael Olsson and Jim
Prewett.