Audit-White-Paper

Comprehensive Event Log MonitoringA White Paper prepared byExecutive SummaryComprehensive event monitoring, to date, has been an expensive or time consumingactivity for system administrators. However, the benefits of inexpensively beingable to monitor a range of event log records, and use them to monitor on and reporton system activities promises to enable a whole new range of security relatedservices, and will add value to current Intrusion Detection systems.The effectiveness and efficiency of event log collection can be undermined by costblowouts, unstable event collection systems, an inundation of events from a varietyor sources, adverse resource utilisation on host systems, lack of a full remote controlfunctionality or a lack of flexibility in the reporting and alerting systems. This paperexplores these problems, and proposes as set of functions required to minimise therisk, and maximise the success of, establishing an effective event logging system.The example of traditional intrusion detection systems is provided, as a basis tooutlining some of the problems which could affect an event logging system.This white paper aims to provide some ideas on these issues, and provide theconcepts behind the release of event logging, Open Source tools, published byIntersect Alliance. Contact :George Cora and Leigh PurdieIntersect Alliance Pty Ltdwhite_paper@intersectalliance.com+61 040 203 3347Version Control:1.0 1 March 2003 InterSect ...