Sponsored Content
Special Forums Cybersecurity best practice for logging options Post 302352441 by jim mcnamara on Friday 11th of September 2009 09:54:31 AM
Old 09-11-2009
Your question is really too open-ended IMO. This is random:

Are there external incoming connections (initiated from outside your firewall)?
Can your box connect to boxes in your DMZ?
Do you use an external DNS name service?
Do you consume web services? Consume external web services? Provide web services?
Do you track security violations? - you should.
Do you audit user activity?
Do you have a data access policy and paperwork to back it up?
Do you have a solid backup process? off site backup? failover?
This list goes on - you get the idea.

There is no single set of 'best practices' for logging - it usually is more a matter of what your box is exposed to, your level of risk tolerance, what the datasets on the server represent, etc. Then there are basics like monitoring the heck out of externally initiated connections.

If you google 'best practices' you will be presented with an onslaught of choices. You have to select the models that fit your system. Apache has great guidelines for example.
But they may make no sense for your situation.
 

8 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

What is the best practice?

I'm playing the shell game of moving and deleting files to make room for current DB backup. A set of files gets moved to serverB when serverA threshold is exceeded. I created two scripts one for serverA and one for serverB. Both scripts are run by cron entry. There is a difference of 12 minutes... (4 Replies)
Discussion started by: BigSky
4 Replies

2. Shell Programming and Scripting

best practice please

I have a data file that I tail and dump the data into a new file at midnight. To work I had to use tail -n2 livefile.csv >> storefile.csv. This is ging me 2 or 3 entries at a time into the storefile.csv. if I continue this then I will have to run a second pass on the file to remove the... (4 Replies)
Discussion started by: Mikey
4 Replies

3. Post Here to Contact Site Administrators and Moderators

Constant Logging In (After Logging Out)

Hi Everyone. First, I want to thank all of you for letting me participate in this great group. I am having a bit of a problem. After I get an email from a responder, I login to make my reply. In the mean time I get another response by email from another member, I go to reply to them and I... (6 Replies)
Discussion started by: Ccccc
6 Replies

4. UNIX for Dummies Questions & Answers

hp ux practice

hi i am new in unix.i have installed linux in my pc,but i want to practice and be expatise in hp ux.but i have no hp server for do it.how could i practice hp ux?please help and give suggestion. (1 Reply)
Discussion started by: dipanjan123
1 Replies

5. Ubuntu

Kernel boot options removed by fault, no boot options

Hello Everyone, First of all, I highly appreciate all Linux forum members and whole Linux community. http://forums.linuxmint.com/images/smilies/icon_wink.gif. I wish you the best for all of you ! I will try to be short and concise: I am using Linux Mint 10 for 2 months on 2 ws, and all went... (3 Replies)
Discussion started by: cdt
3 Replies

6. UNIX for Dummies Questions & Answers

practice scripting

Is there any sites out there that have examples of things they want you to go and script for practice? I have looked around but have came up empty handed. I have been writing scripts for things I need on my nix box but have am wanting more challenging things to keep me learning. I would prefer... (3 Replies)
Discussion started by: linuxn00b
3 Replies

7. HP-UX

LVM PE. Best practice

Hi everyone. Unfortunately I can't find advice's about LVM Physical Extent for HPUX. As far as I know we can set for 1PE size from 1MB to 256 MB. But in what cases it should be different? Maybe exist any strict rules, requirements or any best practice? (2 Replies)
Discussion started by: jess_t03
2 Replies

8. Linux

Syslog not logging successful logging while unlocking server's console

When unlocking a Linux server's console there's no event indicating successful logging Is there a way I can fix this ? I have the following in my rsyslog.conf auth.info /var/log/secure authpriv.info /var/log/secure (1 Reply)
Discussion started by: walterthered
1 Replies
network-test(1) 						  ifupdown-extra						   network-test(1)

NAME
network-test - check the network and test if everything is fine SYNOPSIS
network-test DESCRIPTION
The network-test program will test your system's network configuration using basic tests and providing both information (INFO), warnings (WARN) and possible errors (ERR) based on the results of these tests. It will check and report on: * Status of the network interfaces of the system including: link status, IP addressing and number of transmitted packets and error rates. * Accessibility to configured routes to external networks, including the default network route, checking the routers configured to give access to the network * Proper host resolution, testing DNS resolution against a known host. * Proper network connectivity, testing reachability of remote hosts using ICMP and simulating a web connections to a remote web server (the web server used for the tests can be configured through the environment, see below) The program does not need special privileges to run as it does not do any system change. However, the behaviour of the program when running as an unprivileged user is not the same as running as system administrator (i.e. root). If the program is run as system administrator it will try to run some tools that are only available to it to speed up some of the tests. The program relies on the use of ip, netstat, ifconfig, arp and (when running as root) ethtool or mii-tool, to obtain information about the system's networking configuration (status of available interfaces and configured network routes). It also uses ping, host and nc (netcat) to do tests of the network connectivity and ensure that the host can connect to the Internet. ENVIRONMENT
The program will, by default, check www.debian.org and its associated web server. If you want to use a different check host you can setup the environment as follows: CHECK_HOST The name of a host to use when testing DNS resolution. CHECK_IP_ADRESS The IP address of the host defined in CHECK_HOST CHECK_WEB_HOST The web server to use for testing purposes when testing network connectivity. CHECK_WEB_PORT The web server port of server CHECK_WEB_HOST that will be used for testing. EXIT STATUS
The program will exit with error (1) if any of the network checks fail. BUGS
This program does not have super cow powers so it is unable to fix the errors by itself. It is also unable to detect if the network is failing due to a local firewall policy been in place so make sure you check your system logs with dmesg (1) to detect if some of the active tests are being dropped due to your local firewall. Other known issues that might make the program not work reliable are: * IPv6: The program does not yet explicitly handle IPv6 only hosts, some of the tests might be biased towards IPv4 and might fail in IPv6 environments. * Proxies: The program does not check network connectivity for hosts that connect through the Internet using a proxy gateway for services. The program might report issues in hosts using proxies even when these might connect to the Internet properly through proxied services. * Firewall environments: some of the tests rely on direct connectivity to external hosts, which are tested using ICMP queries (through the use of ping. These tests might fail in hosts installed in networking environments with firewalls that block outbound ICMP communication. SEE ALSO
ip (8), netstat (8), ifconfig (8), ethtool (8), mii-tool (8), ping (8), nc (1) and host (1). AUTHOR
network-test was written by Javier Fernandez-Sanguino for the Debian GNU/Linux distribution. COPYRIGHT AND LICENCE
Copyright (C) 2005-2011 Javier Fernandez-Sanguino <jfs@debian.org>. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2, or (at your option) any later version. On Debian systems, a copy of the GNU General Public License may be found in /usr/share/common-licenses/GPL. ifupdown-extra August 23 2011 network-test(1)
All times are GMT -4. The time now is 12:53 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy