| |||||||||||||
The Journal - a proposed syslog replacementThe Journal - a proposed syslog replacementPosted Nov 20, 2011 20:48 UTC (Sun) by dlang (✭ supporter ✭, #313)In reply to: The Journal - a proposed syslog replacement by jamesh Parent article: The Journal - a proposed syslog replacement
as soon as you allow machines to send messages over the network it is going to be possible for messages to be forged. the receiving machine has no way of knowing what is happening inside the sending machine and if the data it is getting is correct or not.
(Log in to post comments)
This is not entirely true... Posted Nov 20, 2011 20:52 UTC (Sun) by khim (subscriber, #9252) [Link] Actually it's exactly the same as with local logging: of correct authentification scheme is used (i.e.: not syslog's UDP) then they can only be forged after takeover. The messages right before takeover are the most valuable. Sure, you must understand that some messages are are probably forged and some are not, but this is always the case when forensic analisys is done.
|
|||||||||||||