Questions tagged [logging]

Specific to logging of alerts, activities and actions. This also covers user's history managed by software such as browsers.

Filter by
Sorted by
Tagged with
2 votes
2 answers
5k views

Missing Powershell Logging Options in Group Policy Editor

I have configured a Windows 7 domain workstation and a Windows server 2012r2 server as the domain controller. After fully updating both machines, I followed the instructions here: https://msdn....
user avatar
  • 303
1 vote
1 answer
422 views

Is this machine compromised? (iRedMail server, weird logs)

I'm running an iRedMail server on Ubuntu Xenial. Various utilities email me logs and some entries made me suspicious that the machine is hacked. 11 times: [2016-11-19 22:20:19 ±3 seconds] password ...
user avatar
1 vote
1 answer
452 views

Is it generally safe (and compliant) to log a stack trace?

I work on financial web sites that maintain PCI-DSS, FDIC/FFIEC, and ISO-27000 compliance. Also, we are big fans of OWASP :) Our web sites log errors in cleartext to a flat file held on the web ...
user avatar
  • 9,081
0 votes
2 answers
256 views

chat logs seen when on my phone (not compay computer)

can owners of private internet see chat logs when using my phone but their internet? Is this possible. I work in someone's house who is an IT genius and just wondered if they can read my hangout or ...
user avatar
  • 19
-1 votes
1 answer
214 views

Windows logs and Internet activity

If I upload / download any file to/from Gmail is it traceable using Windows logs? What information is exactly stored in Windows logs regarding net browsing?
user avatar
  • 11
1 vote
1 answer
98 views

What methods are there for using an encrypted database to perform logging that is legally and forensically trustworthy?

I am researching logging in a way that it could be used legally and also forensically trustworthy. I have seen discussions about remote logging, hash chaining, timestamp chaining, write-once media. ...
user avatar
1 vote
1 answer
194 views

What is the purpose of this attack?

The following is an excerpt of an apache access log output during the last 24 hours. http://pastebin.com/imtJfvLE Notes: The requests come from more than 5733 unique IP addresses ~2 requests per ...
user avatar
3 votes
1 answer
726 views

Is there any risk of login information being compromised after submitting a Firefox crash report?

Title says it all. I have crash reports specifically disabled and yet the browser submitted one anyway. What's the risk of login information (in particular: saved login info, open sessions in online ...
user avatar
2 votes
2 answers
230 views

ISO 27001 and ChromeOS logging

Is it possible to use ChromeOS devices within an organization that is ISO 27001 compliant? The consultant my employer has hired to assist us in becoming ISO 27001 certified has indicated that ...
user avatar
  • 123
3 votes
6 answers
4k views

Prevent the tampering of the logs of a service

In a security-sensitive service with REST APIs, what is the best way to produce tamper-resistant audit logs? Signing each log entry is a possibility, but that does no prevent a malicious operator ...
user avatar
2 votes
2 answers
174 views

Using a usb to hide logs on computer?

I have been wondering for a while, since (for example on WindowsOS) logs are stored of user activity on the computer and can be retrieved later on by forensic experts easily. Can a user use an ...
user avatar
7 votes
3 answers
410 views

Logging error details in a (desktop) client application

I have a debate about how to properly log errors for the client part (Java Swing) of a client-server application from a security point of view. I think it is common sense that exposing error details ...
user avatar
  • 171
-1 votes
2 answers
440 views

How can you trust your VPN?

What stops a VPN from completely lying to you? Logging everything, snooping on your private information, gathering passwords, not encrypting your packets properly, not giving you the IP they say they ...
user avatar
  • 127
4 votes
1 answer
315 views

Suspicious about no-log VPN policy - anyone care to prove me wrong?

This post may sound pretty silly for you as specialists, but for me it is a serious question I cant find an answer to on the internet. Basically, I wanted to encrypt my net connection - obviously, I'...
user avatar
1 vote
0 answers
223 views

Bizarre HTTP requests to VPS, former malware command and control server?

I just bought a new VPS with Linode. I installed Apache and noticed some very strange behavior that I have been seeing consistently throughout the logs. So basically, I keep receiving stranger HTTP ...
user avatar
1 vote
1 answer
530 views

What defines a Secure Audit Log as such and how do you implement it?

What features would you expect from a secure audit log? Is there more than not being able to change it and make sure you know who wrote it? You do that by hashing the previous entry and signing the ...
user avatar
  • 111
0 votes
1 answer
371 views

Feeding Azure portal logs into a SIEM solution

Currently working on a cloud transformation project where all infrastructure is being placed into Azure. We currently use a SIEM solution to monitor and assess events across the environment. The ...
user avatar
  • 107
1 vote
2 answers
418 views

Undeletable logging or file-writing

I want to log or write files automatically to a un-deletable storage device. Even if the attacker had offline access to the storage device he/she shouldn't be able to delete the files or logs. If ...
user avatar
5 votes
1 answer
230 views

What should I store in the case that a user posts a threatening post?

I am building a social-media type website. I am going to have the users create a profile with their name, email and phone number. When a post is created I plan to have a spot in the database that ...
user avatar
  • 165
2 votes
1 answer
158 views

What is the definition for different access attributes in object access auditing?

Though there is documentation available about configuring Object Access auditing, there is no place where I have found any documents explaining the different attributes in Object Access Auditing. Can ...
user avatar
  • 818
0 votes
3 answers
553 views

Detection of abnormal file access patterns

A company allows its developers access to snapshots of their entire codebase through a local network share. In order to perform their job, the developers compile code daily, where each compile reads a ...
user avatar
1 vote
1 answer
2k views

VPN / VPS and IP logs

Here's the situation: 1) I rent a VPS at a hoster and install VPN on it. 2) Completely disable all logs. Those logs that can not be disabled - permanently delete. 3) I connect to my VPS via VPN (...
user avatar
  • 497
20 votes
7 answers
5k views

Can I trust DNS servers?

If I use my own VPN and use third party DNS - can I trust it? For example, is there any possibilities that an attacker can track the requests by contacting the DNS-hosting (assume that attacker have ...
user avatar
  • 497
0 votes
2 answers
7k views

Repeated "Dos Attack" from remote IPs

I've been having some weird issues with a home network, and it seems to me like I have some vulnerability I don't know about. To be honest, though, I'm not a big network/security guy and I kind of ...
user avatar
  • 11
0 votes
1 answer
1k views

Security considerations in storage of audit logs

How can I securely store audit logs of activity from a system such as together with source data or separately off site?
user avatar
18 votes
5 answers
1k views

Is there a place where I can upload my honeypot logs to?

Maybe a weird question but I've had a public facing HTTP/SSH honeypot for a little bit over a year now and was wondering if there was any place that I can upload my logs to? There are a bunch of ...
user avatar
  • 341
73 votes
9 answers
14k views

I almost searched my password, but didn't press enter. Is my password at risk, because of autocomplete or anything else?

Without even thinking about it, I typed my password into the Google search bar, but I didn't press enter. Since autocomplete is on, does that mean my password has been logged or indexed somewhere? ...
user avatar
  • 681
2 votes
1 answer
913 views

Linux log files to back up and review for security

Good morning/afternoon/evening everyone, I am looking into what files I should consistently back up externally from my machine to be able to monitor for any unusual activity. I would look at the files ...
user avatar
  • 212
5 votes
2 answers
532 views

Is an application backend expected to potentially log sensitive customer data when in debug mode?

As I am working on a website that asks customers to enter data such as their name, address, phone number, obviously customer data that needs to be protected. I do my best to not log such data (...
user avatar
1 vote
1 answer
567 views

Computers connecting to suspicious websites via squid proxy

I am running a squid proxy server on my network which my computers connect through to access the internet. I have noticed several odd entries in the squid access.log file around the same time everyday,...
user avatar
  • 155
0 votes
3 answers
1k views

How does a hack leave no trace in server logs when there is a WORM IDS?

I am wondering if a hacker managed to either SQL inject or social engineer into a database, how does one not leave a trace in the IDS (Intrusion detection like OSSEC)? If an IDS is monitoring the ...
user avatar
  • 1
33 votes
2 answers
14k views

Why would properly logging full http requests be bad practice?

I'm currently looking at Secure Coding Practices documentation provided by Veracode with their code analysis toolsuite. In a "secure logging practices" section, they mention that logging full HTTP ...
user avatar
  • 1,577
1 vote
2 answers
208 views

Security reasons for kicking user when logged in from two places

When account A has logged into computer A, and then account A starts to log in to computer B, account A in computer A will automatically be logged out. May I know what are the possible reasons in why ...
user avatar
1 vote
0 answers
111 views

Is there an easier way to test suricata has enough resources to run without losing packets?

I'd like to see the effect of changing my Suricata hardware and software, and in particular make sure I can determine the rate above which I'll start to lose data. I'm running ESXi with 20 cores and ...
user avatar
  • 11
5 votes
2 answers
7k views

staying not signed in: is it the safest procedure?

each time I do connect to a private or public network I log into websites by keeping the option "stay signed in" or "keep me signed in" unselected, so I have to re-type my username and passwod as ...
user avatar
  • 481
1 vote
2 answers
982 views

MySQL AES_ENCRYPT Logs Output

Need: I need to be able to store AES encrypted user data (journal entries) in my database and those entries need to be plain-text searchable. Issue: MySQL outputs queries to its logs in plain text. ...
user avatar
  • 203
4 votes
2 answers
12k views

Filtering Telegram Traffic

I want to filter Telegram Messenger to monitor the network activities (logging) from any platform. I'm wondering if there is any signature I can look into to detect the traffic, maybe a list of server ...
user avatar
1 vote
2 answers
2k views

Track cmd executions history logs?

I bought a new notebook with Windows 10 Home edition installed on it. The notebook also had tons of other software pre-installed: all kinds of drivers, keyboard back-lighting managers and so on. I've ...
user avatar
1 vote
0 answers
77 views

Can Cisco ASA 5510 (or 5520) suppress its logging when under DOS attack? [closed]

I know that Bluecoat devices for instance can suppress their logging under e.g. bad CPU circumstances like DOS attack. Do other devices like (Cisco ASA) Firewalls protect themselves as well ? Logging ...
user avatar
  • 11
1 vote
1 answer
230 views

Unusual potential vulnerability scan results in Apache logs

Recently I've been seeing entries similar to the following in my Apache access logs. I've replaced the IP address and time with Xs: access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET /js/query-...
user avatar
  • 159
0 votes
1 answer
68 views

Printing and deleting as a security measure

I have an anonymous online community whose posts are deleted from the server after 21 days. In order to provide evidence against bullying and illegal activity, I'd like to keep logs without leaving my ...
user avatar
-1 votes
3 answers
223 views

Design centralized logs collection through USB flash drives using hardware-based security for host computers

I have to centralize logs collection from many different widespread computers on which I can only plug USB flash drives. Those computers should not be reachable from the network in any case to prevent ...
user avatar
  • 99
1 vote
2 answers
1k views

ArcSight logging - Windows Workstations

I am reviewing a security configuration for Workstation security log review, we have an environment wherein the logs are captured and sent to ArcSight tool for analysis. However, how do we validate ...
user avatar
  • 29
-5 votes
2 answers
4k views

How much can the police find about me with only my IP?

So yesterday I had a conversation with a friend. Apparently he had an argument with an other user in a forum, and while both exchanged bad words the other guy told him. I have your IP and mail and ...
user avatar
  • 29
1 vote
1 answer
10k views

Resuming an interrupted nmap scan:

I need to: --resume <filename>: Resume an aborted interrupted scan. But I didn’t: -oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3, ...
user avatar
  • 1,639
3 votes
2 answers
2k views

Is logging a hashed password safe?

I'm creating a login module for Wildfly by extending org.jboss.security.auth.spi.DatabaseServerLoginModule and using log4j2 for debugging. I've gotten into the habit of using log4j2's Logger.entry() ...
user avatar
2 votes
1 answer
7k views

Understanding Snort log

I am new to Snort, and I have ran Snort through a .cap file and got the logs that I should interpret. If I take for instance a block of log like the one below: [**] [1:2463:7] EXPLOIT IGMP IGAP ...
user avatar
1 vote
1 answer
219 views

how to prevent scripts being injected on my website [closed]

I have an API server on Digitalocean. Yesterday they told me I have "a large flood of traffic from one or more of your servers that is disrupting the normal traffic flow for other users." I checked ...
user avatar
5 votes
1 answer
1k views

Logging sensitive data

My bank's android app is logging session ids, account numbers, money transfers and current balance of my account. Is this normal? Do all banks do that? Can a malicious app read my logs and get my ...
user avatar
  • 680
6 votes
1 answer
6k views

How do I identify which PC made a suspicious DNS query?

Our IDS detected a suspicious DNS packet going to a Botnet (or similar). Since that DC is a recursive relay, how can we identify the client who made that request. (Windows DNS server)
user avatar

1 2 3
4
5
8