4 ms·
That's a great point, but I get back to the root question: who's actually looking at this? If people are examining logs it's usually for a particular trigger or
by nkozyra 6y ago
That's a great point, but I get back to the root question: who's actually looking at this? If people are examining logs it's usually for a particular trigger or a problem and filtering that signal from the noise is hard.
- thelamest 6y agoIt's more typical of the servers-as-pets than servers-as-cattle scenario, but sometimes one is simply curious [or extra cautious]. SSH honeypots exist at least in part for this reason.
- boojums 6y ago> servers-as-pets This is a great way to put it.
- jldugger 6y ago> who's actually looking at this? Well, your security team, post incident. But also automated systems like fail2ban.
- warrenm 6y agoAnd log-collectors like Splunk (with configured alerts, etc)
- Sohcahtoa82 6y agoLikely, nobody is directly looking at the logs. But they might be using software that automatically raises an alert when it sees repeated login attempts for a valid username. Isn't that one of the purposes of Splunk?