Re: open source artificial ignorance-like systems
James Turnbull <[email protected]>
| Newsgroups | gmane.comp.sysutils.loganalysis |
|---|---|
| Message-ID | <[email protected]> |
Anton Chuvakin wrote: > Hmm, what's wrong with "grep -v" for artificial ignorance? > >> Like always ignore xyz.*, >> ignore abcd.* unless it happens more than X times in Y time frame > > Well, SEC can do this one ... > > Also, I wouldn't blindly auto-populate the library of things to ignore > - just because something happens 5000 times the first time it does, > doesn't mean its benign :-) I second the recommendation for SEC. It will more than adequately take care of these requirements. I also second the concept of using thresholding for ignoring messages rather than generically ignoring a particular message. http://www.estpak.ee/~risto/sec/ Regards James Turnbull -- James Turnbull <[email protected]> --- Author of Pro Nagios 2.0 (http://www.amazon.com/gp/product/1590596099/) Hardening Linux (http://www.amazon.com/gp/product/1590594444/) --- PGP Key (http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x0C42DF40) _______________________________________________ LogAnalysis mailing list [email protected] http://www.loganalysis.org/mailman/listinfo/loganalysis
signature.asc
(application/pgp-signature, 250 B)
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFGJW7p9hTGvAxC30ARCPpiAJ4mjthDMCLkdYRNGaJGiRmCWGefrgCeOI/b 5jzEMIKW4tthcuB/NQdpo3k= =PNaG -----END PGP SIGNATURE-----