Date: Sat, 18 Sep 1999 22:20:08 -0600 From: Wes Peters <wes@softweyr.com> To: Brett Glass <brett@lariat.org> Cc: "Rodney W. Grimes" <freebsd@gndrsh.dnsmgr.net>, Warner Losh <imp@village.org>, security@FreeBSD.ORG Subject: Re: Real-time alarms Message-ID: <37E46478.6326218E@softweyr.com> References: <199909180612.AAA00597@harmony.village.org> <4.2.0.58.19990918093306.047917c0@localhost> <4.2.0.58.19990918201409.047f9f00@localhost>
next in thread | previous in thread | raw e-mail | index | archive | help
Brett Glass wrote:
>
> At 08:04 PM 9/18/99 -0600, Wes Peters wrote:
>
> >This is what we're talking about with the auditing facility. There are
> >a lot of architectural issues to be solved, starting with "what is an
> >alarm" and ending with "how do I securely transmit the alarms to those
> >who need to know about them"?
> >
> >Fun stuff, eh?
>
> Indeed. Fortunately, many of the tools are already available. E-mail comes
> to mind as the simplest solution to the above, though certainly not the
> only one.
Too clumsy, it pretty much has to be a stream-oriented protocol. Can you
image trying to generate an email message for ever open(2) call that
failed?
OTOH, it probably has to be a multicast protocol, because you may want
notifications to go to multiple targets. This was one of the major problems
with SYS$AUDIT in VMS, all it did was append to the audit logs. Of course,
many vendors, including my former employer, made a good living developing
audit log watchers that could make some intelligent decisions about what
was appearing in the logs and generate mail messages, page people, etc.
--
"Where am I, and what am I doing in this handbasket?"
Wes Peters Softweyr LLC
wes@softweyr.com http://softweyr.com/
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?37E46478.6326218E>