Re: Problem with Logfile Rotation / Inconsistency
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Organization | http://freemail.web.de/ |
| Message-ID | <[email protected]> |
Hello Yoann (and everybody else),
> Could you provide us with the detail of the "logfile inconsistency"
> generated alerts (use prelude-manager --debug, and send the relevant
> alerts to the list).
>
> It should contain information that will help tracing the problem.
Sure thing, maybe a bit much - is there a more elegant way posting these kind of information instead of copy&paste ?
----------------------------------------------------------------------- Snip -----------------------------------------------------------------------
version:
alert:
messageid: 1830862515809
analyzer(0):
analyzerid: 1379063655314903
name: ids-master
manufacturer: http://www.prelude-ids.com
model: Prelude Manager
version: 0.9.10
class: Concentrator
ostype: FreeBSD
osversion: 6.2-RELEASE-p8
node:
category: unknown (0)
location: City
name: ids-master
address(0):
category: ipv4-addr (7)
address: xxx.xxx.xxx.xxx
netmask: 255.255.255.0
process:
name: prelude-manager
pid: 77726
path: /usr/local/bin/prelude-manager
analyzer(1):
analyzerid: 4087830808197253
name: host-1
manufacturer: http://www.prelude-ids.com
model: Prelude LML
version: 0.9.11
class: Log Analyzer
ostype: FreeBSD
osversion: 6.3-PRERELEASE
node:
category: unknown (0)
location: City
name: host-1
address(0):
category: ipv4-addr (7)
address: xxx.xxx.xxx.xxx
netmask: 255.255.xxx.xxx
process:
name: prelude-lml
pid: 11308
path: /usr/local/bin/prelude-lml
create_time: 25/03/2008 13:00:00.672531 +00:00
classification:
text: Log file inconsistency
detect_time: 25/03/2008 13:00:00.672509 +00:00
analyzer_time: 25/03/2008 13:00:00.672579 +00:00
target(0):
decoy: unknown (0)
file(0):
name: auth.log
path: /var/log/auth.log
modify_time: 25/03/2008 13:00:00.0 +00:00
access_time: 25/03/2008 13:00:00.0 +00:00
data_size: 60
inode:
number: 447543
category: current (1)
assessment:
impact:
severity: high (4)
completion: succeeded (2)
type: file (3)
description: An attacker might have modified the log file in order to remove the trace he left.
additional_data(0):
type: string (0)
meaning: Log received from
data: /var/log/auth.log
version:
alert:
messageid: 1865222254177
analyzer(0):
analyzerid: 1379063655314903
name: ids-master
manufacturer: http://www.prelude-ids.com
model: Prelude Manager
version: 0.9.10
class: Concentrator
ostype: FreeBSD
osversion: 6.2-RELEASE-p8
node:
category: unknown (0)
location: City
name: ids-master
address(0):
category: ipv4-addr (7)
address: xxx.xxx.xxx.xxx
netmask: 255.255.255.0
process:
name: prelude-manager
pid: 77726
path: /usr/local/bin/prelude-manager
analyzer(1):
analyzerid: 4087830808197253
name: host-1
manufacturer: http://www.prelude-ids.com
model: Prelude LML
version: 0.9.11
class: Log Analyzer
ostype: FreeBSD
osversion: 6.3-PRERELEASE
node:
category: unknown (0)
location: City
name: host-1
address(0):
category: ipv4-addr (7)
address: xxx.xxx.xxx.xxx
netmask: 255.255.xxx.xxx
process:
name: prelude-lml
pid: 11308
path: /usr/local/bin/prelude-lml
create_time: 25/03/2008 14:00:01.250812 +00:00
classification:
text: Log file inconsistency
detect_time: 25/03/2008 14:00:01.250790 +00:00
analyzer_time: 25/03/2008 14:00:01.250857 +00:00
target(0):
decoy: unknown (0)
file(0):
name: messages
path: /var/log/messages
modify_time: 25/03/2008 14:00:00.0 +00:00
access_time: 25/03/2008 14:00:00.0 +00:00
data_size: 60
inode:
number: 447551
category: current (1)
assessment:
impact:
severity: high (4)
completion: succeeded (2)
type: file (3)
description: An attacker might have modified the log file in order to remove the trace he left.
additional_data(0):
type: string (0)
meaning: Log received from
data: /var/log/messages
version:
alert:
messageid: 4815864190088
analyzer(0):
analyzerid: 1379063655314903
name: ids-master
manufacturer: http://www.prelude-ids.com
model: Prelude Manager
version: 0.9.10
class: Concentrator
ostype: FreeBSD
osversion: 6.2-RELEASE-p8
node:
category: unknown (0)
location: City
name: ids-master
address(0):
category: ipv4-addr (7)
address: xxx.xxx.xxx.xxx
netmask: 255.255.255.0
process:
name: prelude-manager
pid: 77726
path: /usr/local/bin/prelude-manager
analyzer(1):
analyzerid: 4208248816220940
name: host-2
manufacturer: http://www.prelude-ids.com
model: Prelude LML
version: 0.9.11
class: Log Analyzer
ostype: FreeBSD
osversion: 6.3-RELEASE-p1
node:
category: unknown (0)
location: City
name: host-2
address(0):
category: ipv4-addr (7)
address: xxx.xxx.xxx.xxx
netmask: 255.255.255.0
process:
name: prelude-lml
pid: 36328
path: /usr/local/bin/prelude-lml
create_time: 25/03/2008 14:00:01.299041 +00:00
classification:
text: Log file inconsistency
detect_time: 25/03/2008 14:00:01.299035 +00:00
analyzer_time: 25/03/2008 14:00:01.299061 +00:00
target(0):
decoy: unknown (0)
file(0):
name: auth.log
path: /var/log/auth.log
modify_time: 25/03/2008 14:00:00.0 +00:00
access_time: 25/03/2008 14:00:00.0 +00:00
data_size: 60
inode:
number: 47108
category: current (1)
assessment:
impact:
severity: high (4)
completion: succeeded (2)
type: file (3)
description: An attacker might have modified the log file in order to remove the trace he left.
additional_data(0):
type: string (0)
meaning: Log received from
data: /var/log/auth.log
----------------------------------------------------------------------- Snip -----------------------------------------------------------------------
Thank you again,
David
_________________________________________________________________________
In 5 Schritten zur eigenen Homepage. Jetzt Domain sichern und gestalten!
Nur 3,99 EUR/Monat! http://www.maildomain.web.de/?mc=021114
_______________________________________________
Prelude-user site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-user