« Audit/Monitor Controls or Audit/Monitor BEFORE Control? | Main | Poll #7: What tools do you use for Windows Event Log collection? »
Logging Poll #6 "Which Logs Do You LOOK At?" Analysis
This poll on looking at logs poll was relatively popular; lets see what we can learn (live results are also here).
First, what are the top 3 log types that people look at? They are:
- Unix/Linux server syslog
- Web server logs
- Firewall logs
How does that compare with the top 3 log types that people collect (see picture showing results from my previous poll below)?
These are:
- Unix/Linux server syslog
- Firewall logs
- Web server logs
Huh? They are the same - doesn't it just make sense? What are the possibilities here?
a. People only collect the logs they plan to look at, OR
b. People only look at logs they collect (duh!).
Strangely, I find a) unlikely; I think most people collect more than they can review and that the incident/issue response and compliance needs drive collection more than review or analysis.
Another observation is that all of the "big 3" log types are useful for security, operations and compliance and not just for security (like NIDS/NIPS logs). Is that why they are so popular?
Second, I was fearful that "I only look at whatever logs needed for the incident/issue investigation" will win. It didn't!!! This to me indicates that proactive log review is not as unpopular as I feared. Good! It is working.
Third, obviously, nobody (well, 4%...) looks at all logs they collect.
Fourth, much more people look at Unix/Linux logs than Windows server logs (factor of 3x); this is not entirely unexpected and my next poll will drill down into this.
Finally, I am SHOCKED that people don't look at NIDS/NIPS logs (only 11% do). Why have you deployed those "beasts" if you don't look at what they produce? Then again, maybe you haven't...
Next poll coming up!
Posted March 07, 2008 in Innovation , Log Management & Intelligence | Permalink
TrackBack
TrackBack URL for this entry:
http://www.loglogic.com/mt/mt-tb.cgi/304
June 2008
| Sun | Mon | Tue | Wed | Thu | Fri | Sat |
|---|---|---|---|---|---|---|
| 1 | 2 | 3 | 4 | 5 | 6 | 7 |
| 8 | 9 | 10 | 11 | 12 | 13 | 14 |
| 15 | 16 | 17 | 18 | 19 | 20 | 21 |
| 22 | 23 | 24 | 25 | 26 | 27 | 28 |
| 29 | 30 |
Categories
Archives
- June 2008
- May 2008
- April 2008
- March 2008
- February 2008
- January 2008
- December 2007
- November 2007
- October 2007
- September 2007
- August 2007
- July 2007
- June 2007
- May 2007
- April 2007
- March 2007
- February 2007
- January 2007
- December 2006
- November 2006
- October 2006
- September 2006
- August 2006
- July 2006
- June 2006
- May 2006
- April 2006
- March 2006
- February 2006
- January 2006
- December 2005
- November 2005
- October 2005
- September 2005