SecurityRatty: Fun Log-reading

This is cache of http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~3/275162169/fun-log-reading.html. Cache is the snapshot of article that we took when we index feed.
To see original page click here.
We are not affiliated with the authors of this article and not responsible for its content.

Fun Log-reading

2008-04-21 21:24:00 by Dr Anton Chuvakin in Anton Chuvakin Blog -

Now, some of you are on the verge of saying "Anton! Stop reading (and posting links) - start writing already..."

I will, I will :-)

But for now, here is some fun log-related stuff, in one enjoyable pile:

Logs and security (clouded) by BeastOrBudda. Good content on tracking activities thru various logs and HOT video link (here)
Is It Better To Leave Some Logs Behind? (full text) Good discussion on whether "collect everything" (every log) is the right strategy in all cases. Sadly, but yes, some logs are so poorly done (Solaris BSM anyone? :-) [some of the logs there are worth dumping...]) that they are truly useless for most conceivable purposes and can be thrown away with no loss of useful information whatsoever.
"Description of security events in Windows Vista and in Windows Server 2008" - read it if you are into sort of thing :-)

Enjoy!