Re: [logs] Eventlog to syslog Mar 01 2008 04:34AM tbird
precision-guesswork com (1 replies) Quoting David Corlette
<DCorlette (at) novell (dot) com [email concealed]>:  > Why not
have them implement a modern, secure auditing standard? The >
CEE and XDAS work is promising, and is getting analysts
attention > (Burton, for one). They aren't complete yet, but if
you look at > the requirements they embody you will see why
insecure syslog > really isn't the way to go. In fact, *nix OSs
are moving away > from syslog - witness LAF on Linux, BSM on
Solaris, etc.... > Anything that might have security-relevance
needs to be treated a > little more carefully. > And yeah, I
know that there are all sorts of more secure extensions > to
syslog, but they aren't "standards," at least not yet.  Whoa,
d00d, talk about comparing apples and oranges...you've got
apples, tomatoes, sheep and, uh, oil filters in there ;-) There
are at least 4 different areas to consider:  - what events to
record -- and what information is vital for ea