Questions tagged [logging]
Specific to logging of alerts, activities and actions. This also covers user's history managed by software such as browsers.
382
questions
42
votes
3
answers
10k
views
Should Failed Login Attempts Be Logged
Should failed login attempts be logged? My doubt is that if there is a distributed brute force attack, it might exhaust the available disk space of the database. What is the best practice for this?
I'...
1
vote
1
answer
107
views
separate log for windows [closed]
Hi I am trying to find a comprehensive all-event logging for windows 10. This doesn't have to be a product, it can be a script. I don't care.
Problem: My pc is being attacked continuously but the ...
5
votes
0
answers
258
views
http request: your killing me smalls [duplicate]
I was looking through my Apache Status in WHM and noticed this odd line in the log:
POST /your/killing/me/smalls.jpg HTTP/1.1
It is mostly from 54.86.11.108 but I have seen at least one other IP.
I'...
3
votes
3
answers
2k
views
Logging POST body?
I understand that most web servers and web apps do not keep the body of HTTP POST requests in their logs. The reason for this is I assume the potentially large size of the bodies and the possibly ...
2
votes
2
answers
5k
views
Missing Powershell Logging Options in Group Policy Editor
I have configured a Windows 7 domain workstation and a Windows server 2012r2 server as the domain controller. After fully updating both machines, I followed the instructions here: https://msdn....
1
vote
1
answer
533
views
Is this machine compromised? (iRedMail server, weird logs)
I'm running an iRedMail server on Ubuntu Xenial. Various utilities email me logs and some entries made me suspicious that the machine is hacked.
11 times:
[2016-11-19 22:20:19 ±3 seconds] password ...
1
vote
1
answer
616
views
Is it generally safe (and compliant) to log a stack trace?
I work on financial web sites that maintain PCI-DSS, FDIC/FFIEC, and ISO-27000 compliance. Also, we are big fans of OWASP :)
Our web sites log errors in cleartext to a flat file held on the web ...
0
votes
2
answers
274
views
chat logs seen when on my phone (not compay computer)
can owners of private internet see chat logs when using my phone but their internet? Is this possible. I work in someone's house who is an IT genius and just wondered if they can read my hangout or ...
-1
votes
1
answer
238
views
Windows logs and Internet activity
If I upload / download any file to/from Gmail is it traceable using Windows logs? What information is exactly stored in Windows logs regarding net browsing?
1
vote
1
answer
116
views
What methods are there for using an encrypted database to perform logging that is legally and forensically trustworthy?
I am researching logging in a way that it could be used legally and also forensically trustworthy. I have seen discussions about remote logging, hash chaining, timestamp chaining, write-once media. ...
1
vote
1
answer
218
views
What is the purpose of this attack?
The following is an excerpt of an apache access log output during the last 24 hours. http://pastebin.com/imtJfvLE
Notes:
The requests come from more than 5733 unique IP addresses
~2 requests per ...
3
votes
1
answer
988
views
Is there any risk of login information being compromised after submitting a Firefox crash report?
Title says it all. I have crash reports specifically disabled and yet the browser submitted one anyway. What's the risk of login information (in particular: saved login info, open sessions in online ...
2
votes
2
answers
283
views
ISO 27001 and ChromeOS logging
Is it possible to use ChromeOS devices within an organization that is ISO 27001 compliant?
The consultant my employer has hired to assist us in becoming ISO 27001 certified has indicated that ...
4
votes
6
answers
5k
views
Prevent the tampering of the logs of a service
In a security-sensitive service with REST APIs, what is the best way to produce tamper-resistant audit logs?
Signing each log entry is a possibility, but that does no prevent a malicious operator ...
2
votes
2
answers
209
views
Using a usb to hide logs on computer?
I have been wondering for a while, since (for example on WindowsOS) logs are stored of user activity on the computer and can be retrieved later on by forensic experts easily. Can a user use an ...
7
votes
3
answers
480
views
Logging error details in a (desktop) client application
I have a debate about how to properly log errors for the client part (Java Swing) of a client-server application from a security point of view.
I think it is common sense that exposing error details ...
-1
votes
2
answers
468
views
How can you trust your VPN?
What stops a VPN from completely lying to you? Logging everything, snooping on your private information, gathering passwords, not encrypting your packets properly, not giving you the IP they say they ...
4
votes
1
answer
352
views
Suspicious about no-log VPN policy - anyone care to prove me wrong?
This post may sound pretty silly for you as specialists, but for me it is a serious question I cant find an answer to on the internet.
Basically, I wanted to encrypt my net connection - obviously, I'...
1
vote
0
answers
242
views
Bizarre HTTP requests to VPS, former malware command and control server?
I just bought a new VPS with Linode. I installed Apache and noticed some very strange behavior that I have been seeing consistently throughout the logs. So basically, I keep receiving stranger HTTP ...
1
vote
1
answer
596
views
What defines a Secure Audit Log as such and how do you implement it?
What features would you expect from a secure audit log?
Is there more than not being able to change it and make sure you know who wrote it?
You do that by hashing the previous entry and signing the ...
0
votes
1
answer
419
views
Feeding Azure portal logs into a SIEM solution
Currently working on a cloud transformation project where all infrastructure is being placed into Azure.
We currently use a SIEM solution to monitor and assess events across the environment. The ...
1
vote
2
answers
476
views
Undeletable logging or file-writing
I want to log or write files automatically to a un-deletable storage device.
Even if the attacker had offline access to the storage device he/she shouldn't be able to delete the files or logs.
If ...
5
votes
1
answer
257
views
What should I store in the case that a user posts a threatening post?
I am building a social-media type website. I am going to have the users create a profile with their name, email and phone number. When a post is created I plan to have a spot in the database that ...
2
votes
1
answer
177
views
What is the definition for different access attributes in object access auditing?
Though there is documentation available about configuring Object Access auditing, there is no place where I have found any documents explaining the different attributes in Object Access Auditing. Can ...
0
votes
3
answers
637
views
Detection of abnormal file access patterns
A company allows its developers access to snapshots of their entire codebase through a local network share. In order to perform their job, the developers compile code daily, where each compile reads a ...
1
vote
1
answer
2k
views
VPN / VPS and IP logs
Here's the situation:
1) I rent a VPS at a hoster and install VPN on it.
2) Completely disable all logs. Those logs that can not be disabled - permanently delete.
3) I connect to my VPS via VPN (...
20
votes
7
answers
5k
views
Can I trust DNS servers?
If I use my own VPN and use third party DNS - can I trust it?
For example, is there any possibilities that an attacker can track the requests by contacting the DNS-hosting (assume that attacker have ...
0
votes
2
answers
7k
views
Repeated "Dos Attack" from remote IPs
I've been having some weird issues with a home network, and it seems to me like I have some vulnerability I don't know about. To be honest, though, I'm not a big network/security guy and I kind of ...
0
votes
1
answer
1k
views
Security considerations in storage of audit logs
How can I securely store audit logs of activity from a system such as together with source data or separately off site?
18
votes
5
answers
1k
views
Is there a place where I can upload my honeypot logs to?
Maybe a weird question but I've had a public facing HTTP/SSH honeypot for a little bit over a year now and was wondering if there was any place that I can upload my logs to? There are a bunch of ...
73
votes
9
answers
14k
views
I almost searched my password, but didn't press enter. Is my password at risk, because of autocomplete or anything else?
Without even thinking about it, I typed my password into the Google search bar, but I didn't press enter. Since autocomplete is on, does that mean my password has been logged or indexed somewhere? ...
2
votes
1
answer
1k
views
Linux log files to back up and review for security
Good morning/afternoon/evening everyone, I am looking into what files I should consistently back up externally from my machine to be able to monitor for any unusual activity. I would look at the files ...
6
votes
2
answers
710
views
Is an application backend expected to potentially log sensitive customer data when in debug mode?
As I am working on a website that asks customers to enter data such as their name, address, phone number, obviously customer data that needs to be protected.
I do my best to not log such data (...
1
vote
1
answer
706
views
Computers connecting to suspicious websites via squid proxy
I am running a squid proxy server on my network which my computers connect through to access the internet. I have noticed several odd entries in the squid access.log file around the same time everyday,...
0
votes
3
answers
1k
views
How does a hack leave no trace in server logs when there is a WORM IDS?
I am wondering if a hacker managed to either SQL inject or social engineer into a database, how does one not leave a trace in the IDS (Intrusion detection like OSSEC)?
If an IDS is monitoring the ...
37
votes
2
answers
17k
views
Why would properly logging full http requests be bad practice?
I'm currently looking at Secure Coding Practices documentation provided by Veracode with their code analysis toolsuite.
In a "secure logging practices" section, they mention that logging full HTTP ...
1
vote
2
answers
224
views
Security reasons for kicking user when logged in from two places
When account A has logged into computer A, and then account A starts to log in to computer B, account A in computer A will automatically be logged out. May I know what are the possible reasons in why ...
1
vote
0
answers
130
views
Is there an easier way to test suricata has enough resources to run without losing packets?
I'd like to see the effect of changing my Suricata hardware and software, and in particular make sure I can determine the rate above which I'll start to lose data. I'm running ESXi with 20 cores and ...
5
votes
2
answers
8k
views
staying not signed in: is it the safest procedure?
each time I do connect to a private or public network I log into websites by keeping the option "stay signed in" or "keep me signed in" unselected, so I have to re-type my username and passwod as ...
1
vote
2
answers
1k
views
MySQL AES_ENCRYPT Logs Output
Need: I need to be able to store AES encrypted user data (journal entries) in my database and those entries need to be plain-text searchable.
Issue: MySQL outputs queries to its logs in plain text.
...
4
votes
2
answers
13k
views
Filtering Telegram Traffic
I want to filter Telegram Messenger to monitor the network activities (logging) from any platform. I'm wondering if there is any signature I can look into to detect the traffic, maybe a list of server ...
1
vote
2
answers
3k
views
Track cmd executions history logs?
I bought a new notebook with Windows 10 Home edition installed on it. The notebook also had tons of other software pre-installed: all kinds of drivers, keyboard back-lighting managers and so on.
I've ...
1
vote
0
answers
96
views
Can Cisco ASA 5510 (or 5520) suppress its logging when under DOS attack? [closed]
I know that Bluecoat devices for instance can suppress their logging under e.g. bad CPU circumstances like DOS attack.
Do other devices like (Cisco ASA) Firewalls protect themselves as well ?
Logging ...
1
vote
1
answer
260
views
Unusual potential vulnerability scan results in Apache logs
Recently I've been seeing entries similar to the following in my Apache access logs. I've replaced the IP address and time with Xs:
access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET /js/query-...
0
votes
1
answer
84
views
Printing and deleting as a security measure
I have an anonymous online community whose posts are deleted from the server after 21 days. In order to provide evidence against bullying and illegal activity, I'd like to keep logs without leaving my ...
-1
votes
3
answers
273
views
Design centralized logs collection through USB flash drives using hardware-based security for host computers
I have to centralize logs collection from many different widespread computers on which I can only plug USB flash drives. Those computers should not be reachable from the network in any case to prevent ...
1
vote
2
answers
1k
views
ArcSight logging - Windows Workstations
I am reviewing a security configuration for Workstation security log review, we have an environment wherein the logs are captured and sent to ArcSight tool for analysis. However, how do we validate ...
-5
votes
2
answers
5k
views
How much can the police find about me with only my IP?
So yesterday I had a conversation with a friend. Apparently he had an argument with an other user in a forum, and while both exchanged bad words the other guy told him.
I have your IP and mail and ...
2
votes
1
answer
13k
views
Resuming an interrupted nmap scan:
I need to:
--resume <filename>: Resume an aborted interrupted scan.
But I didn’t:
-oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3,
...
3
votes
2
answers
3k
views
Is logging a hashed password safe?
I'm creating a login module for Wildfly by extending org.jboss.security.auth.spi.DatabaseServerLoginModule and using log4j2 for debugging.
I've gotten into the habit of using log4j2's Logger.entry() ...