6 ms·

There's a lot of value. For example, if you see failed logins against random user names like "dbadmin" or "root" it's likely just random scanning, but what if s

There's a lot of value. For example, if you see failed logins against random user names like "dbadmin" or "root" it's likely just random scanning, but what if suddenly lots and lots of valid user names appear?

gruez 6y ago
>but what if suddenly lots and lots of valid user names appear? then what are you going to do?
- sokoloff 6y ago
  At a minimum, spend some of my limited time and attention on this issue rather than the 100s of other things that might be clamoring for my time.
  - wbl 6y ago
    What are you going to do to solve that issue?
- cedilla 6y ago
  Well that would highly depend on what I'm seeing. If it's a single user there might be an attack on the way against that user. If it's multiple users, there might have been a compromise of some credentials. It's definitely something you need to investigate.
cthalupa 6y ago
grep and zgrep will work wonders for checking for actual usernames in these logs even if they have significant amount of spam in them.
nkozyra 6y ago
That's a great point, but I get back to the root question: who's actually looking at this? If people are examining logs it's usually for a particular trigger or a problem and filtering that signal from the noise is hard.
- thelamest 6y ago
  It's more typical of the servers-as-pets than servers-as-cattle scenario, but sometimes one is simply curious [or extra cautious]. SSH honeypots exist at least in part for this reason.
  - boojums 6y ago
    > servers-as-pets This is a great way to put it.
- jldugger 6y ago
  > who's actually looking at this? Well, your security team, post incident. But also automated systems like fail2ban.
  - warrenm 6y ago
    And log-collectors like Splunk (with configured alerts, etc)
- Sohcahtoa82 6y ago
  Likely, nobody is directly looking at the logs. But they might be using software that automatically raises an alert when it sees repeated login attempts for a valid username. Isn't that one of the purposes of Splunk?

gruez 6y ago

>but what if suddenly lots and lots of valid user names appear? then what are you going to do?

sokoloff 6y ago
At a minimum, spend some of my limited time and attention on this issue rather than the 100s of other things that might be clamoring for my time.
- wbl 6y ago
  What are you going to do to solve that issue?
cedilla 6y ago
Well that would highly depend on what I'm seeing. If it's a single user there might be an attack on the way against that user. If it's multiple users, there might have been a compromise of some credentials. It's definitely something you need to investigate.

cthalupa 6y ago

grep and zgrep will work wonders for checking for actual usernames in these logs even if they have significant amount of spam in them.

nkozyra 6y ago

That's a great point, but I get back to the root question: who's actually looking at this? If people are examining logs it's usually for a particular trigger or a problem and filtering that signal from the noise is hard.

thelamest 6y ago
It's more typical of the servers-as-pets than servers-as-cattle scenario, but sometimes one is simply curious [or extra cautious]. SSH honeypots exist at least in part for this reason.
- boojums 6y ago
  > servers-as-pets This is a great way to put it.
jldugger 6y ago
> who's actually looking at this? Well, your security team, post incident. But also automated systems like fail2ban.
- warrenm 6y ago
  And log-collectors like Splunk (with configured alerts, etc)
Sohcahtoa82 6y ago
Likely, nobody is directly looking at the logs. But they might be using software that automatically raises an alert when it sees repeated login attempts for a valid username. Isn't that one of the purposes of Splunk?