Section 4 Flashcards
What do system logs track?
System shut down and driver failure
What do security logs track?
Successful and unsuccessful log on attempts
What do application logs track?
OS and third party app events
Where do you look for the logs?
/var/logs and event viewer and SYSLOG
What is the BEST way to look at logs?
SYSLOG server
What are the 3 versions of SYSLOG in order from oldest to newest?
SYSLOG, RSYSLOG (Linux), SYSLOG-NG (Linux)
What is netflow for?
Created by Cisco. Collects IP network traffic. It gives a summary of how traffic is flowing in or out of the network. It is not a packet capture tool.
It gives information such as who is using the most bandwidth and why is traffic spiking at certain times.
What is sflow short for and what is its purpose?
Sampled Flow; its an open source version of netflow. It exports a samples of network flows.
What is Internet Protocol Flow Information Export (IPFix)?
It’s essentially a standardized system that tracks information for billing/accounting systems. Phone companies use this to track your minutes and data usage in order to bill you based on your usage.
What is Metadata?
It’s analytical data about data.
What is journalctl used for?
Linux command line to query and display logs from journald which is the systemd logging service on linux.
What is nxlog?
Cross-platform, open source. Very similar to RSYSLOG, and SYSLOG-NG, except that it can work on Windows.
