How often should Admins review their logs? Also logging login attempts...

Hello all,

Hopefully a couple of quick questions. I am going to be questioning a few MS admins on log monitoring (Event, System, Security via Event viewer) soon and while I have our policies and standards ruling how often they should do their reviews - I wanted to broker some opinions - don't know if I will get opinons here, but what on your thoughts on how often an admin should review their logs? Once a week, once a day, every second they're awake or other?

Also, thoughts having systems log login attempts, successful and unsuccessful? Should it be done or not? I ask because our organization is looking to turn it off in order to save on disk space... I have not had a chance to slap people around with a flounder to ask more questions about it - but I heard some IT people wanted to turn off that logging... thoughts?

TIA!

Hello all,

Hopefully a couple of quick questions. I am going to be questioning a few MS admins on log monitoring (Event, System, Security via Event viewer) soon and while I have our policies and standards ruling how often they should do their reviews - I wanted to broker some opinions - don't know if I will get opinons here, but what on your thoughts on how often an admin should review their logs? Once a week, once a day, every second they're awake or other?

Also, thoughts having systems log login attempts, successful and unsuccessful? Should it be done or not? I ask because our organization is looking to turn it off in order to save on disk space... I have not had a chance to slap people around with a flounder to ask more questions about it - but I heard some IT people wanted to turn off that logging... thoughts?

TIA!

...hmmm.. my answer may not be correct, but it is exist some software that can monitor and manage logs, clear all good and keep bad and also send/show alerts....

it can be some way to use some network driver to store logs on?

wait for more answers......
I have no much experiens yet.....

...hmmm.. my answer may not be correct, but it is exist some software that can monitor and manage logs, clear all good and keep bad and also send/show alerts....

it can be some way to use some network driver to store logs on?

wait for more answers......
I have no much experiens yet.....

There are Syslog services out there for free, (which may be against your security policy), that will send the event logs to a Syslog server - and therefore in a text format which is a lot less disk intensive. You can then tell the local logs to overwrite themselves at 500k if you like - no big deal, the text file still holds the log entries. I log almost everything and make about 130Mb of text a day weekdays and 60-70Mb a weekend in a 600 user network.... I could cut that down a lot but I like the addidional detail.

There are Syslog services out there for free, (which may be against your security policy), that will send the event logs to a Syslog server - and therefore in a text format which is a lot less disk intensive. You can then tell the local logs to overwrite themselves at 500k if you like - no big deal, the text file still holds the log entries. I log almost everything and make about 130Mb of text a day weekdays and 60-70Mb a weekend in a 600 user network.... I could cut that down a lot but I like the addidional detail.

I normally check the logs everyday on all critical servers. As for the others i look at them once a week. And as Tiger Shark said its great using a syslog server to centralize all logs, it makes your life easier. I like to log everything that can be logged since i tend to pick up problems before they become major inconvenience.

Well first thing logs are the most common ways to trace any unsuall activity, right if you dont have them obviously chances to see what happen are less. As far as checking is concerned it depends upon how critical is your server? if its highly critical then you should check your log daily. I used to check my servers logs 3-4 times a week. I had problem in the past and realize that its the best thing to have event view believe me before the occurance of the problem I used to think these logs are dumb but now i have realized there importance.

So You should keep them and check them regularly.

There are higher level questions that must be asked first.

What are the requirements of the system?
What is your standard logging architecture?
What has your organization decided is an acceptable level of logging?

Approaching this from the bottom up instead of the top down is a bad idea. Also, picking arbitrary intervals because they sound good or extra secure is also not a good approach. You can waste a lot of resources which could be used elsewhere. An example of this would be having a 24x7 armed guard watch your garbage cans down by the curb. Sure, you may have placed something in the garbage that is sensative but you're not going to have an armed guard there to protect against a dumpster diver.

So, figure out what the higher level requirements are (your security policy isn't where you find this by the way, it should be in your standards or other supporting documentation) and then apply those to this system.

So in the end, no one here can decide what the proper logging inteval is for you. If you are still unsure, you need to do a risk analysis and assessment. This can be performed by a third party and may be beneficial in your case if you're struggling with this issue.


--TH13

We're introducing software to help with this task. It was taking up a lot of time for the apps team to check logs every day. We're putting in software which will collate and compress the logs and allow us to run scheduled reports for them to see every morning, saving the manual sift. The software also alerts in real time for anything they have chosen to be of significance, a service stopping for instance.

We've go to hold the data for a minimum period to comply with some of our legislation and the software will also facilitate us.

Best to check what legislation you come under. It may affect what you are logging and the way in which you do it. You might be like us and find that a manual check is not viable in the long term and need a software solution.

Excellent. Thank you everyone for your advice! A lot of great ideas!

TH13 on your questions:

Quote:

---

What are the requirements of the system?
What is your standard logging architecture?
What has your organization decided is an acceptable level of logging?

---

I don't think the organization has done that for it's servers - as it appears this change they want to make - not logging came out of the blue. A risk assessment does not appear to have been done. BTW - they want to turn off all logging of login attempts across all AD servers - again from that approach, I do not believe a risk assessment was done. A presumption I am making - based on the information I have right now is that IT is responding to the some pain - the pain of disk space being chewed up by logging - and are looking for a quick fix.

The problem that I have observed is that this IT organization has to do that a lot of the time, because IT is looked down upon or as seen as not critical to the organization - which is interesting considering the amount of revenue that passes through the systems each day. I agree, we need to start from the bottom up, not from the top down and not just react to a situation or crisis - we need to establish a proactive IT organization to help drive the business - this situation only highlights and underscores that need.

Thanks again for the information - once I am back in town - I will be approaching IT, along with my colleagues, on this matter.

Quote:

---

IT is responding to the some pain - the pain of disk space being chewed up by logging - and are looking for a quick fix.

---

Well, this sounds like a bad descision was made. It is well understood that all log data is not valuable but the organization has to define what data is valuable and "clip" off the rest. If this was done, disk space would not be an issue. Also, mandates may *require* you to retain this data long term (SOX for instance). Tossing log data because it's a pain is a baaad thing to do. Your management chain does not seem to be bound to organizational descisions. In other words, the patients are running the assylum.

Quote:

---

The problem that I have observed is that this IT organization has to do that a lot of the time, because IT is looked down upon or as seen as not critical to the organization

---

This is because security was not considered from the beginning. You have to win the hearts and minds of an executive in your organization and work hard to sell the *fact* that good security results in more efficient and ultimately a more profitable business.

There are many ways to approach this but it is key to get executive buy in or you're done before you even begin.

Quote:

---

There are many ways to approach this but it is key to get executive buy in or you're done before you even begin.

---

It is _very_ important to select this exec carefully. Failure to do so results in a waste of time....

Selection criteria:-

1. The chosen exec must have some grasp of IT issues, principles and practice.

2. The chosen exec must have a good grasp of the business processes within the organization.

3. The chosen exec _must_ have influence at the highest levels of the organization.

4. The chosen exec _must_ be trusted at the highest levels of the organization.

5. The chosen exec must be able to grasp the theory of risk assessment and it's consequences.

6. The chosen exec should trust the IT dept.

Three and four above are absolutely essential... Get as many of the others as you possible can. Throwing darts at the internal phone book is remarkably ineffective when trying to locate the appropriate exec... ;)

TH13 and TS - thanks again - great advice! Yes - as you may be able to discern this is an organization built on other technologies and now IT was "back-ended" into it as a necessity, however, the necessity for IT, not to mention security, has had a less than favorable welcome. I wish you could be where I am at right now - everyone in this community would be aghast at what I discover at times - especially this week.

You are both correct - I need to - like post-haste contact my colleague and manager on this topic - TH13 - SOx and 21 CFR Part 11 escaped my thoughts until you mentioned it - I bet the IT AD group forgot that as well - I was too peeved at the idea of a blanket turn off of logging to see clearly.

I believe the executives will be a challenge - there is another issue I was just told about today that made my jaw go through the table - basically personnel in security - doing forensics investigations in IT - no - not yet - they are untrained in anything with IT security - don't even ask about forensics. And that was the start of it. AUUGH!

...
..
.

I just had an epiphany... what we are dealing with may be in part why I am experiencing what I am and posted my whining me'ah: http://www.antionline.com/showthread...hreadid=273222

Thanks again for the great advice and wisdom on this!