| |||||||||||||
This is not entirely true...This is not entirely true...Posted Nov 20, 2011 20:52 UTC (Sun) by khim (subscriber, #9252)In reply to: The Journal - a proposed syslog replacement by dlang Parent article: The Journal - a proposed syslog replacement
Actually it's exactly the same as with local logging: of correct authentification scheme is used (i.e.: not syslog's UDP) then they can only be forged after takeover. The messages right before takeover are the most valuable. Sure, you must understand that some messages are are probably forged and some are not, but this is always the case when forensic analisys is done.
(Log in to post comments)
|
|||||||||||||