Questions tagged [logging]

Specific to logging of alerts, activities and actions. This also covers user's history managed by software such as browsers.

Filter by
Sorted by
Tagged with
42 votes
3 answers
10k views

Should Failed Login Attempts Be Logged

Should failed login attempts be logged? My doubt is that if there is a distributed brute force attack, it might exhaust the available disk space of the database. What is the best practice for this? I'...
John L.'s user avatar
  • 741
1 vote
1 answer
107 views

separate log for windows [closed]

Hi I am trying to find a comprehensive all-event logging for windows 10. This doesn't have to be a product, it can be a script. I don't care. Problem: My pc is being attacked continuously but the ...
karen popper's user avatar
5 votes
0 answers
258 views

http request: your killing me smalls [duplicate]

I was looking through my Apache Status in WHM and noticed this odd line in the log: POST /your/killing/me/smalls.jpg HTTP/1.1 It is mostly from 54.86.11.108 but I have seen at least one other IP. I'...
RozzA's user avatar
  • 201
3 votes
3 answers
2k views

Logging POST body?

I understand that most web servers and web apps do not keep the body of HTTP POST requests in their logs. The reason for this is I assume the potentially large size of the bodies and the possibly ...
pineappleman's user avatar
  • 2,299
2 votes
2 answers
5k views

Missing Powershell Logging Options in Group Policy Editor

I have configured a Windows 7 domain workstation and a Windows server 2012r2 server as the domain controller. After fully updating both machines, I followed the instructions here: https://msdn....
Beetle's user avatar
  • 303
1 vote
1 answer
533 views

Is this machine compromised? (iRedMail server, weird logs)

I'm running an iRedMail server on Ubuntu Xenial. Various utilities email me logs and some entries made me suspicious that the machine is hacked. 11 times: [2016-11-19 22:20:19 ±3 seconds] password ...
Atte Juvonen's user avatar
1 vote
1 answer
616 views

Is it generally safe (and compliant) to log a stack trace?

I work on financial web sites that maintain PCI-DSS, FDIC/FFIEC, and ISO-27000 compliance. Also, we are big fans of OWASP :) Our web sites log errors in cleartext to a flat file held on the web ...
John Wu's user avatar
  • 9,311
0 votes
2 answers
274 views

chat logs seen when on my phone (not compay computer)

can owners of private internet see chat logs when using my phone but their internet? Is this possible. I work in someone's house who is an IT genius and just wondered if they can read my hangout or ...
sam's user avatar
  • 19
-1 votes
1 answer
238 views

Windows logs and Internet activity

If I upload / download any file to/from Gmail is it traceable using Windows logs? What information is exactly stored in Windows logs regarding net browsing?
mg123's user avatar
  • 11
1 vote
1 answer
116 views

What methods are there for using an encrypted database to perform logging that is legally and forensically trustworthy?

I am researching logging in a way that it could be used legally and also forensically trustworthy. I have seen discussions about remote logging, hash chaining, timestamp chaining, write-once media. ...
AztecJones's user avatar
1 vote
1 answer
218 views

What is the purpose of this attack?

The following is an excerpt of an apache access log output during the last 24 hours. http://pastebin.com/imtJfvLE Notes: The requests come from more than 5733 unique IP addresses ~2 requests per ...
Jack Palkens's user avatar
3 votes
1 answer
988 views

Is there any risk of login information being compromised after submitting a Firefox crash report?

Title says it all. I have crash reports specifically disabled and yet the browser submitted one anyway. What's the risk of login information (in particular: saved login info, open sessions in online ...
user1258361's user avatar
2 votes
2 answers
283 views

ISO 27001 and ChromeOS logging

Is it possible to use ChromeOS devices within an organization that is ISO 27001 compliant? The consultant my employer has hired to assist us in becoming ISO 27001 certified has indicated that ...
Folk's user avatar
  • 123
4 votes
6 answers
5k views

Prevent the tampering of the logs of a service

In a security-sensitive service with REST APIs, what is the best way to produce tamper-resistant audit logs? Signing each log entry is a possibility, but that does no prevent a malicious operator ...
MarinaLilv's user avatar
2 votes
2 answers
209 views

Using a usb to hide logs on computer?

I have been wondering for a while, since (for example on WindowsOS) logs are stored of user activity on the computer and can be retrieved later on by forensic experts easily. Can a user use an ...
user3676224's user avatar
7 votes
3 answers
480 views

Logging error details in a (desktop) client application

I have a debate about how to properly log errors for the client part (Java Swing) of a client-server application from a security point of view. I think it is common sense that exposing error details ...
lgraf's user avatar
  • 171
-1 votes
2 answers
468 views

How can you trust your VPN?

What stops a VPN from completely lying to you? Logging everything, snooping on your private information, gathering passwords, not encrypting your packets properly, not giving you the IP they say they ...
user51819's user avatar
  • 127
4 votes
1 answer
352 views

Suspicious about no-log VPN policy - anyone care to prove me wrong?

This post may sound pretty silly for you as specialists, but for me it is a serious question I cant find an answer to on the internet. Basically, I wanted to encrypt my net connection - obviously, I'...
That Curious Guy's user avatar
1 vote
0 answers
242 views

Bizarre HTTP requests to VPS, former malware command and control server?

I just bought a new VPS with Linode. I installed Apache and noticed some very strange behavior that I have been seeing consistently throughout the logs. So basically, I keep receiving stranger HTTP ...
Viperidae's user avatar
1 vote
1 answer
596 views

What defines a Secure Audit Log as such and how do you implement it?

What features would you expect from a secure audit log? Is there more than not being able to change it and make sure you know who wrote it? You do that by hashing the previous entry and signing the ...
daefu's user avatar
  • 111
0 votes
1 answer
419 views

Feeding Azure portal logs into a SIEM solution

Currently working on a cloud transformation project where all infrastructure is being placed into Azure. We currently use a SIEM solution to monitor and assess events across the environment. The ...
JLPH's user avatar
  • 107
1 vote
2 answers
476 views

Undeletable logging or file-writing

I want to log or write files automatically to a un-deletable storage device. Even if the attacker had offline access to the storage device he/she shouldn't be able to delete the files or logs. If ...
user avatar
5 votes
1 answer
257 views

What should I store in the case that a user posts a threatening post?

I am building a social-media type website. I am going to have the users create a profile with their name, email and phone number. When a post is created I plan to have a spot in the database that ...
Dallas's user avatar
  • 165
2 votes
1 answer
177 views

What is the definition for different access attributes in object access auditing?

Though there is documentation available about configuring Object Access auditing, there is no place where I have found any documents explaining the different attributes in Object Access Auditing. Can ...
brcsp's user avatar
  • 818
0 votes
3 answers
637 views

Detection of abnormal file access patterns

A company allows its developers access to snapshots of their entire codebase through a local network share. In order to perform their job, the developers compile code daily, where each compile reads a ...
LivingInformation's user avatar
1 vote
1 answer
2k views

VPN / VPS and IP logs

Here's the situation: 1) I rent a VPS at a hoster and install VPN on it. 2) Completely disable all logs. Those logs that can not be disabled - permanently delete. 3) I connect to my VPS via VPN (...
ideloxew's user avatar
  • 507
20 votes
7 answers
5k views

Can I trust DNS servers?

If I use my own VPN and use third party DNS - can I trust it? For example, is there any possibilities that an attacker can track the requests by contacting the DNS-hosting (assume that attacker have ...
ideloxew's user avatar
  • 507
0 votes
2 answers
7k views

Repeated "Dos Attack" from remote IPs

I've been having some weird issues with a home network, and it seems to me like I have some vulnerability I don't know about. To be honest, though, I'm not a big network/security guy and I kind of ...
SkyEx's user avatar
  • 11
0 votes
1 answer
1k views

Security considerations in storage of audit logs

How can I securely store audit logs of activity from a system such as together with source data or separately off site?
AuditStudent's user avatar
18 votes
5 answers
1k views

Is there a place where I can upload my honeypot logs to?

Maybe a weird question but I've had a public facing HTTP/SSH honeypot for a little bit over a year now and was wondering if there was any place that I can upload my logs to? There are a bunch of ...
vladimir's user avatar
  • 341
73 votes
9 answers
14k views

I almost searched my password, but didn't press enter. Is my password at risk, because of autocomplete or anything else?

Without even thinking about it, I typed my password into the Google search bar, but I didn't press enter. Since autocomplete is on, does that mean my password has been logged or indexed somewhere? ...
Randy's user avatar
  • 681
2 votes
1 answer
1k views

Linux log files to back up and review for security

Good morning/afternoon/evening everyone, I am looking into what files I should consistently back up externally from my machine to be able to monitor for any unusual activity. I would look at the files ...
IT_User's user avatar
  • 212
6 votes
2 answers
710 views

Is an application backend expected to potentially log sensitive customer data when in debug mode?

As I am working on a website that asks customers to enter data such as their name, address, phone number, obviously customer data that needs to be protected. I do my best to not log such data (...
Alexis Wilke's user avatar
  • 1,007
1 vote
1 answer
706 views

Computers connecting to suspicious websites via squid proxy

I am running a squid proxy server on my network which my computers connect through to access the internet. I have noticed several odd entries in the squid access.log file around the same time everyday,...
synthesis's user avatar
  • 155
0 votes
3 answers
1k views

How does a hack leave no trace in server logs when there is a WORM IDS?

I am wondering if a hacker managed to either SQL inject or social engineer into a database, how does one not leave a trace in the IDS (Intrusion detection like OSSEC)? If an IDS is monitoring the ...
clark's user avatar
  • 1
37 votes
2 answers
17k views

Why would properly logging full http requests be bad practice?

I'm currently looking at Secure Coding Practices documentation provided by Veracode with their code analysis toolsuite. In a "secure logging practices" section, they mention that logging full HTTP ...
niilzon's user avatar
  • 1,629
1 vote
2 answers
224 views

Security reasons for kicking user when logged in from two places

When account A has logged into computer A, and then account A starts to log in to computer B, account A in computer A will automatically be logged out. May I know what are the possible reasons in why ...
user avatar
1 vote
0 answers
130 views

Is there an easier way to test suricata has enough resources to run without losing packets?

I'd like to see the effect of changing my Suricata hardware and software, and in particular make sure I can determine the rate above which I'll start to lose data. I'm running ESXi with 20 cores and ...
tpc1095's user avatar
  • 11
5 votes
2 answers
8k views

staying not signed in: is it the safest procedure?

each time I do connect to a private or public network I log into websites by keeping the option "stay signed in" or "keep me signed in" unselected, so I have to re-type my username and passwod as ...
franz1's user avatar
  • 481
1 vote
2 answers
1k views

MySQL AES_ENCRYPT Logs Output

Need: I need to be able to store AES encrypted user data (journal entries) in my database and those entries need to be plain-text searchable. Issue: MySQL outputs queries to its logs in plain text. ...
jpodwys's user avatar
  • 203
4 votes
2 answers
13k views

Filtering Telegram Traffic

I want to filter Telegram Messenger to monitor the network activities (logging) from any platform. I'm wondering if there is any signature I can look into to detect the traffic, maybe a list of server ...
Z. Kiwan's user avatar
1 vote
2 answers
3k views

Track cmd executions history logs?

I bought a new notebook with Windows 10 Home edition installed on it. The notebook also had tons of other software pre-installed: all kinds of drivers, keyboard back-lighting managers and so on. I've ...
Creative Magic's user avatar
1 vote
0 answers
96 views

Can Cisco ASA 5510 (or 5520) suppress its logging when under DOS attack? [closed]

I know that Bluecoat devices for instance can suppress their logging under e.g. bad CPU circumstances like DOS attack. Do other devices like (Cisco ASA) Firewalls protect themselves as well ? Logging ...
Wheel's user avatar
  • 11
1 vote
1 answer
260 views

Unusual potential vulnerability scan results in Apache logs

Recently I've been seeing entries similar to the following in my Apache access logs. I've replaced the IP address and time with Xs: access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET /js/query-...
Sommel's user avatar
  • 169
0 votes
1 answer
84 views

Printing and deleting as a security measure

I have an anonymous online community whose posts are deleted from the server after 21 days. In order to provide evidence against bullying and illegal activity, I'd like to keep logs without leaving my ...
JacobPariseau's user avatar
-1 votes
3 answers
273 views

Design centralized logs collection through USB flash drives using hardware-based security for host computers

I have to centralize logs collection from many different widespread computers on which I can only plug USB flash drives. Those computers should not be reachable from the network in any case to prevent ...
doxav's user avatar
  • 99
1 vote
2 answers
1k views

ArcSight logging - Windows Workstations

I am reviewing a security configuration for Workstation security log review, we have an environment wherein the logs are captured and sent to ArcSight tool for analysis. However, how do we validate ...
tulasi's user avatar
  • 29
-5 votes
2 answers
5k views

How much can the police find about me with only my IP?

So yesterday I had a conversation with a friend. Apparently he had an argument with an other user in a forum, and while both exchanged bad words the other guy told him. I have your IP and mail and ...
Alex's user avatar
  • 29
2 votes
1 answer
13k views

Resuming an interrupted nmap scan:

I need to: --resume <filename>: Resume an aborted interrupted scan. But I didn’t: -oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3, ...
voices's user avatar
  • 1,779
3 votes
2 answers
3k views

Is logging a hashed password safe?

I'm creating a login module for Wildfly by extending org.jboss.security.auth.spi.DatabaseServerLoginModule and using log4j2 for debugging. I've gotten into the habit of using log4j2's Logger.entry() ...
Michael Guinn's user avatar

1 2 3
4
5
8