4 ms·
I went in to this article thinking, "this guy is stupid." I came away thinking, "syslog is stupid."
by Hnrobert42 10y ago
I went in to this article thinking, "this guy is stupid." I came away thinking, "syslog is stupid."
- TenOhms 10y agoWorking with SIEMS a lot, I agree it needs a serious revision. 1. Define an encryption standard, both symmetric and asymmetric (to prevent log tampering). 2. Define a compression standard, with scheduling options similar to cron jobs but defined in syslog.conf. 3. Overhaul the facility field, define some generic ones like "Auth", "Audit", "Kernel" etc and don't hardcode any numeric mappings. Article covers this well. 4. Make CEF the standard format for writing logs to disk or forwarding to other devices. All modern applications and kernels should be writing their logs in CEF format.