LogBlog

« On Natural Flow of Log Management | Main | ROI of PCI compliance »

What Happens if Logs Aren't There ...

Seeing this story  where logs weren't available when sorely needed for an investigations inspired me to finish my own version of that...  First, let me quote  the conclusions from the above post.

Indeed, there is no better way to say it. But - guess what - despite us saying this (and even pointing glaring mistakes), a lot of people still choose to ignore logs. What can we use to help them, even despite themselves? Maybe a bit of FUD can help?  Yes, while many proclaim that people need to be naturally drawn towards doing "the right thing" and that scaring people into action is not that efficient (especially, if you do this one too many times...). However, this is the world we live in and in it, FUD works. FUD sells insurance as well as safety features in cars and other products, moves compliance solutions, makes people read and update their boring DR and BC plans, and causes a lot of other good overall :-)

And, indeed, one can get desensitized if you hear that "sky is falling" too often, but here is the thing: I think that one should be willing to take the risk of such "desensitization", especially given that sky is indeed "not quite static" ...

So, let's look at one such scenario in this post (which is, as they say, "inspired by a true story"). Imagine you have a Windows Active Directory (AD) server (or a domain controller) that holds all of the accounts for a good part of your organization. One notable morning you get calls from dozens of frantic users (yes, including your boss's boss :-( and maybe even his boss ... ) who are unable to login  to their Windows systems. Their computers reject their apparently valid logon credentials. You check the account settings on your AD box and your face turn pale: there aren't any user domain accounts. The term would be "mysteriously vanished" :-) Where do you go next? Windows event logs on the AD server, of course. Good thinking! However, AD servers and domain controllers (DCs) are famous for being very "chatty", often producing hundreds of event log records per second on busy networks. Thus, when you look at the logs you notice that the entries older than 8 hours (!) got rotated into oblivion. And there is nothing that points at the account disappearance within the remaining puddle of log data. Argggh!

Now, what do you do next? Do you feel at least a little fear about your job, maybe also feeling slightly uncertain of what exactly happened with your server or even doubtful that you can prevent it, if it were to happen again. Maybe your IT team has an SLA to worry about? Which has your boss's bonus dependent on it? What if it happens again tomorrow (after you painstakingly restored all the accounts based on old records, incremental backups and the info from the users)? And why can't it? - you have no idea why it happened this time... Are your servers compromised - or was it just a junior sysadmin error? Or a new Windows bug? You truly have no way of knowing, which, as we all know, doesn't help you to feel brave, certain and doubtless...

Now, if only you bought that log management solution and started collecting and analyzing logs before, and not after the incident. Imagine how the life would be different!

Posted January 21, 2007 in | Permalink

TrackBack

TrackBack URL for this entry:
http://www.loglogic.com/mt/mt-tb.cgi/124

Post a comment

Visit loglogic.com

I ♥ Logs

Subscribe to this blog’s feed RSS

June 2008
Sun Mon Tue Wed Thu Fri Sat
1 2 3 4 5 6 7
8 9 10 11 12 13 14
15 16 17 18 19 20 21
22 23 24 25 26 27 28
29 30          
Categories
Archives
Blogroll
Blogroll
Compliance
Good Reading
LogLogic
LogLogic Partners
Sites We Watch