Re: Log integrity handling on central logsystem

John H. Sawyer wrote:
>If you could afford two systems, have your one system accepting the logs
>and another system that has no IP sniffing the wire for the logs as they
>go by. Now you have two sources and can compare them later.

By the way, if anyone wants it:
http://www.ranum.com/security/computer_security/index.html
"plog" -- a promiscuous mode syslog collector. It pulls up
UDP syslog packets, rips the syslog data right out of them
and injects them up /dev/log.

On good hardware it may be more reliable than syslogd
because it bypasses UDP input queues.

mjr.