auditing on SWiK

Main Page - Free IPA

Mon, 23 Jun 2008 08:07:41 -0700

security information management

Main Page - Free IPA

Mon, 23 Jun 2008 08:04:45 -0700

security information management

BlogNotes from Kenan Sevindik : Weblog

Fri, 13 Jun 2008 15:15:22 -0700

Simple MySQL Auditing

Wed, 11 Jun 2008 14:16:54 -0700

Simple auditing, i.e., knowing what changed recently, can save you tons of time while troubleshooting.

I know that, in the ideal world:

Everything is supposed to be done through configuration management.
Everything is documented and all changes are tracked through a VCS.
Every DDL or set global is trapped via MySQL Proxy and logged.

But there are always ways to bypass the gatekeepers. Changes can go in unnoticed. An hour or so later, your database performance suddenly changes for the worse, and you get that phone call.

First you check if anything caused an actual error. You look around at a few log files and nothing shows up. The next thing you ask yourself is, did someone change anything in the last little while. Of course, everybody says no. After a few hours of digging, comparing schemas, diff-ing old and current config files, you actually find what has changed, put it back the way it was and everything is back to normal. You ask the question again, did anybody change the global variable from X to Y, and someone finally admits it. But they thought that it was not relevant since they did that change on the weekend and the system performance didn’t go down the toilet until Monday morning around 9:00am. Sound familiar?

We have all gone through this many times, and it doesn’t matter what process you have in place — something always slips through the cracks.

I came up with some simple stored procedure that will compare two data sets and keep track of the changes historically. It’s loosely based on slowly-changing dimension type 2 in the data warehouse world (google Ralph Kimball if you want to get all the gory details). This method tracks only changes, so you should be able to keep historical rows forever, unless you are constantly dropping and creating whatever you are tracking.

Say you want to keep track of my.cnf or global variables changes. This one of the simplest tables to track, the information_schema — it has only two columns. Others, such as tables or routines, would make the SQL to compare a little more involved.

First you need a table to track this with. I called mine historical_global_variable. It has the two columns from the original table plus three additional ones:

(more…)

Postfix monitoring with David Schweikert's Mailgraph?

Sat, 17 May 2008 12:07:45 -0700

Lynis

Fri, 16 May 2008 16:15:13 -0700

SourceForge.net: samba audit

Tue, 01 Jan 2008 17:57:58 -0800

Samba Logging for Audit Trails

Tue, 01 Jan 2008 16:57:42 -0800

Auditing for Samba

Tue, 01 Jan 2008 16:57:42 -0800

CensorNet Ltd - Professional & Affordable Web and E-mail Filtering for business, education, ISP, VAR

Thu, 08 Nov 2007 17:13:48 -0800

here

Sun, 04 Nov 2007 18:22:19 -0800

bunny-the-fuzzer - Google Code

Wed, 31 Oct 2007 15:24:50 -0700

"Bunny the Fuzzer A closed loop, high-performance, general purpose protocol-blind fuzzer for C programs. Uses compiler-level integration to seamlessly inject precise and reliable instrumentation hooks into the traced program. These hooks enable the

NGN - Firefox als hacktool

Wed, 31 Oct 2007 03:03:50 -0700

Richard's C# blog : Super easy SQL Server 2005 Database Schema change auditing

Thu, 25 Oct 2007 19:59:39 -0700

Nmap

Tue, 02 Oct 2007 12:36:43 -0700

OpenSource network management utility.

[CentOS] Syslog x Samba VFS audit

Fri, 14 Sep 2007 07:54:53 -0700

An Auditing Solution with XML And XSL

Mon, 20 Aug 2007 11:49:29 -0700

Edge-Security - Wfuzz

Wed, 01 Aug 2007 10:26:54 -0700

SourceForge.net: Open Source EAM/CMMS

Sat, 16 Jun 2007 06:42:16 -0700

A Tapestry of Thoughts: Glassfish And Audit Logging

Wed, 16 May 2007 10:34:12 -0700

Glassfish And Audit Logging

HackBar :: Firefox Add-ons

Wed, 04 Apr 2007 15:07:21 -0700

FireCAT - Firefox Catalog of Auditing Tools »

Wed, 28 Mar 2007 22:23:44 -0700

FireCAT - Firefox Catalog of Auditing Tools backbone spilled these bits on March 27th 2007 @ 7:42 am After the web 2.0 hacking with firefox and its plugins article I wrote some months ago, recently I found a new way to transform firefox in the ultimate pe

Object auditing with the use of Hibernate, database triggers and views

Fri, 23 Mar 2007 10:18:55 -0700

Babel Enterprise

Thu, 15 Feb 2007 21:39:28 -0800

Snort - the de facto standard for intrusion detection/prevention

Sat, 10 Feb 2007 05:39:25 -0800

The open source NIDS that started it all.

Snort - the de facto standard for intrusion detection/prevention

Sat, 10 Feb 2007 05:15:12 -0800

The open source NIDS that started it all.

Snort Report: Fundamentals and installation tips for the channel

Mon, 01 Jan 2007 17:28:39 -0800

Snort Report: Fundamentals and installation tips for the channel

Hibernate Forums - View topic - Interceptor to create history / activity records

Mon, 18 Sep 2006 00:08:39 -0700

hibernate.org - Audit Logging

Wed, 02 Aug 2006 03:56:50 -0700

SourceForge.net: Portable Linux Auditing CD

Tue, 11 Jul 2006 08:51:10 -0700