Hi Dale. Dale Amon wrote:
The only thing you can do is to make damn certain your box does not become part of the problem.I'll add to that: make sure you actually check your logs. I use syslog-ng tobring all essential realtime logging to a hardened server;
I'll add another one to that: I started using syslogd-sql, which is a modified version of "the" syslog 1.4.1 that also allows logging to a MySQL database. I hope it is a step in the right direction to use advances SQL queries in order to support analyzation of logfiles. Any opinions on that from the more experiences ones on this list? :)
Bye, Mike