From owner-freebsd-security Sat Sep 18 21:31:27 1999 Delivered-To: freebsd-security@freebsd.org Received: from lariat.lariat.org (lariat.lariat.org [206.100.185.2]) by hub.freebsd.org (Postfix) with ESMTP id 07A5515049 for ; Sat, 18 Sep 1999 21:31:22 -0700 (PDT) (envelope-from brett@lariat.org) Received: from mustang (IDENT:ppp0.lariat.org@lariat.lariat.org [206.100.185.2]) by lariat.lariat.org (8.9.3/8.9.3) with ESMTP id WAA28914; Sat, 18 Sep 1999 22:31:03 -0600 (MDT) Message-Id: <4.2.0.58.19990918222636.047a1880@localhost> X-Sender: brett@localhost X-Mailer: QUALCOMM Windows Eudora Pro Version 4.2.0.58 Date: Sat, 18 Sep 1999 22:30:56 -0600 To: Wes Peters From: Brett Glass Subject: Re: Real-time alarms Cc: "Rodney W. Grimes" , Warner Losh , security@FreeBSD.ORG In-Reply-To: <37E46478.6326218E@softweyr.com> References: <199909180612.AAA00597@harmony.village.org> <4.2.0.58.19990918093306.047917c0@localhost> <4.2.0.58.19990918201409.047f9f00@localhost> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org At 10:20 PM 9/18/99 -0600, Wes Peters wrote: >Too clumsy, it pretty much has to be a stream-oriented protocol. Or something like syslogd? >Can you >image trying to generate an email message for ever open(2) call that >failed? No, but how about a compilation? Or a warning saying, "Looky here, there's something going on; check the logs for details"? >OTOH, it probably has to be a multicast protocol, because you may want >notifications to go to multiple targets. This was one of the major problems >with SYS$AUDIT in VMS, all it did was append to the audit logs. Of course, >many vendors, including my former employer, made a good living developing >audit log watchers that could make some intelligent decisions about what >was appearing in the logs and generate mail messages, page people, etc. I think that some combination of local logging, remote logging, and mail notification would work. Again, these should be universal facilities. People have many complaints about syslogd -- in particular, that it can be a wonderful remote disk filler. Maybe fixing syslogd would go hand in hand with creating such a facility. --Brett To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message