Re: [lopsa-tech] Server Overload and Log Processing

2015-08-22 Thread David Lang
There are lots of tools out there for watching logs and alerting on specific patterns. I believe that logwatch just looks at the logs a line at a time, not trying to keep context Simple Event correlator can match on individual lines, but can also keep context so that it can alert on combinat

Re: [lopsa-tech] Server Overload and Log Processing

2015-08-22 Thread Graham Dunn
The Linux logwatch package operates on a "these patterns are okay, these patterns are bad, anything else is unmatched, here's those ones" basis. There are many modules for different daemons. It might be a good starting point. On Sat, Aug 22, 2015 at 10:16 AM Edward Ned Harvey (lopser) < lop...@ned

Re: [lopsa-tech] Server Overload and Log Processing

2015-08-22 Thread Edward Ned Harvey (lopser)
I am surprised nobody had a "just use this product" or "just google for this search term" response - Let me describe a little more what I'm looking for - So you create a VM, and turn on apache. Of course it has a default config file, including a default number of MPM preforks and threads and

Re: [lopsa-tech] Firewall change requests -- Looking for a solution

2015-08-22 Thread David Lang
On Sat, 22 Aug 2015, john boris wrote: David Thank you for the info. This is for a large school district where the teachers at the schools decide their lesson plan and class most likely at home and then in the classroom find out the site is blocked for some reason. We have no formal process in p

Re: [lopsa-tech] Firewall change requests -- Looking for a solution

2015-08-22 Thread john boris
David Thank you for the info. This is for a large school district where the teachers at the schools decide their lesson plan and class most likely at home and then in the classroom find out the site is blocked for some reason. We have no formal process in place now. From your reply you are on the s

Re: [lopsa-tech] Firewall change requests -- Looking for a solution

2015-08-22 Thread David Lang
What are you looking for as being 'timely'? I've seen that term applied to a couple weeks between submission and implementation and at other times, hours beween submission and impelmentation wasn't considered good enough :-) Personally, I believe the most important thing is that whatever proces

Re: [lopsa-tech] getting a list of critical vulnerabilities from the NVD at NIST

2015-08-22 Thread Aleksey Tsalolikhin
Nice. Lynis sounds like a modern Titan ( https://www.usenix.org/legacy/event/lisa98/full_papers/farmer/farmer.pdf) On Thu, Aug 20, 2015 at 8:19 PM, Atom Powers wrote: > You may be interested in Lynis and how Assimilation is extending the data. > https://github.com/CISOfy/lynis > http://itbestpr

Re: [lopsa-tech] Firewall change requests -- Looking for a solution

2015-08-22 Thread john boris
David I am looking for the process people may have used to handle the requests so they are timely. On Saturday, August 22, 2015, David Lang wrote: > On Fri, 21 Aug 2015, john boris wrote: > > Here at $WORK we have a distributed Web Filtering system. We have just >> started looking to streamline

Re: [lopsa-tech] Firewall change requests -- Looking for a solution

2015-08-22 Thread David Lang
On Fri, 21 Aug 2015, john boris wrote: Here at $WORK we have a distributed Web Filtering system. We have just started looking to streamline the process. I figured that other large school districts have done this already or attempted it so I will ask here. We have 18 High Schools and 140 Element

Re: [lopsa-tech] Server Overload and Log Processing

2015-08-22 Thread David Lang
On Fri, 21 Aug 2015, Edward Ned Harvey (lopser) wrote: I want to know if a web server gets overrun by too much traffic requests. I certainly know how to monitor memory, and tweak the MPM and stuff in apache config files, but I assume if it runs out of threads or memory or anything, it will thr