|visits||member for||3 years|
|seen||Jan 28 '12 at 2:37|
Where can I find exploit code?
The point is if he can't confirm if they are false positive or not he will be blindly running exploits and ultimately wasting his time.
Server compromised for 2nd time, cannot locate source of attack
+1 for Splunk. Please note that the free version supports up to 500MB of logs. If you are doing more it won't be much of a help. Enable rsyslog (if you did not already) to ship the logs to a different server. Depending on your need you can set it up to rotate every 5m, 1h, etc. Please note that some of the suggestions will add penalty to performance. Which under some circumstances can inflect DoS on your server. The good thing about OSSEC is that you can deploy the agent and have the server somewhere else. You can still monitor your system (failed logins, etc) without affecting performance.