Re: [Prelude-IDS - The Hybrid IDS framework] Website News
"Sebastien Tricaud" <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
On Fri, Feb 15, 2008 at 10:52 AM, <[email protected]> wrote: > Aww, come on ! Not even one opinion or hint in order to help me ! > Am I really the only one having this kind of problem ? First of all, learn to express yourself correctly. We are *not* on MSN here. > > How do you other people manage to securely monitor your logfile rotation ? > There must be something ! There is an alert for this, which is called "Log file deletion", see the prelude lml code: #define LOGFILE_DELETION_CLASS "Log file deletion" #define LOGFILE_DELETION_IMPACT "An attacker might have erased the logfile," \ "or a log rotation program may have rotated the logfile." #define LOGFILE_DELETION_IMPACT_HIGH "An attacker seems to have erased the log file, " \ "and the change doesn't seem to be related to a log " \ "rotation program." > > If log monitoring isn't reliable or dependable at all i can't continue using > prelude as a hybrid ids. sad but fact. > Sad for you maybe, but for us we prefer to help people who are not threatening us because they are too lame to ask correctly something they need. _______________________________________________ Prelude-user site list [email protected] http://www.prelude-ids.org/mailman/listinfo/prelude-user