Re: Different logging formats, standardization...

[Erich Schubert <erich@debian.org>]

man syslog states:
    LOG_EMERG        system is unusable
    LOG_ALERT        action must be taken immediately
    LOG_CRIT         critical conditions
    LOG_ERR          error conditions
    LOG_WARNING      warning conditions
    LOG_NOTICE       normal, but significant, condition
    LOG_INFO         informational message
    LOG_DEBUG        debug-level message

That is all we have.
Now thing of a attack warning your system is not vulnerable to.
It certainly qualifies for info. Maybe even notice or warning.
Depending on the users preferences.
If an attacker tries lots of different "old vulnerabilites", i'd like to
see a warning condition at least...

Or take this message from my logs:
  sshd[17934]: scanned from 217.96.131.90 with SSH-1.0-SSH_Version_Mapper.  Don't panic.
Kind of funny we need this "Don't panic." there?

Now have a look how different services log failed logins:
  proftpd[8438]: serverhostname (clienthost[ip]) - USER username: no
such user found from clienthost [ip] to serverip:port
has rendundant information: clienthost+ip is there two times.

Now sshd:
  sshd[16440]: pam_ldap: error trying to bind as user "<LDAPip>" (Invalid credentials)
  sshd[16440]: Failed password for <username> from <ip> port 2599 ssh2

My radius, courier-pop and courier-imap server log into auth.log:
PAM_unix[23085]: check pass; user unknown
PAM_unix[23085]: authentication failure; (uid=0) -> **unknown** for radius service
PAM_unix[21628]: authentication failure; (uid=0) -> **unknown** for pop3 service
PAM_unix[10755]: authentication failure; (uid=0) -> **unknown** for imap service

missing the useful information "hostname".

newer imp logs:
IMP[7443]: FAILED <ip> to <servername>:143 as <username>

IMHO these should be unified to use a common format for failed logins.
<service>: login failed for <userid> from <hostname>[ip]: <additional info>

Greetings,
Erich

-- 
        erich@(mucl.de|debian.org)        --        GPG Key ID: 4B3A135C
        A polar bear is a rectangular bear after a coordinate transform.
  Es ist besser, geliebt und verloren zu haben, als niemals geliebt zu haben.
            "Wissen ist Macht" - wenn man das richtige daraus macht.