Developer and Fusion Middleware 1 _ Kevin Powe _ Log files - a wealth of forensic evidence.pdf

Log
ﬁles:

A
wealth
of
forensic
evidence

Kevin
Powe

Integral
Technology
Solu6ons

The most comprehensive Oracle applications & technology content under one roof

More
info
at
h:p://bit.ly/kapowelogs


Forensic process

Log files

Case files

Tools


The Forensic Process


Step One: Secure The Scene


Operating System Evidence

netstat

for
network
issues

top

or

Windows
Task
Manager
for
CPU
issues

iostat
or
vmstat
for
I/O
issues


Rolling Log Files


Cause Symptoms

2-‐4PM
4-‐6PM


Step Two: Investigate The Scene


Don’t.
Search.
The.
Log.
Files.


‘Error’

versus

‘Warning’

‘Failing’

versus

‘Failed’


Step Three: Gather And Correlate
Evidence


Step Four: Build A Hypothesis


1) Secure the scene

2) Investigate the scene

3) Gather and correlate evidence

4) Build a hypothesis


WebLogic
Server
Domain

AdminServer
managedServer1

Java

managedServer2

processes


HTTP Access Logs


192.168.5.6
-‐
-‐
[19/Nov/2010:13:34:49
+0800]
"POST
/AccountServices/ProxyServices/AccountServices
HTTP/1.1"
200
29487

192.168.5.6
-‐
-‐
[19/Nov/2010:13:34:49
+0800]
"POST
/WarehousingServices/ProxyServices/RequestOrderDetails
HTTP/1.1"
200
1167

rfc931
date

Remote
host
authuser

192.168.5.6

-‐

-‐

[19/Nov/2010:13:34:49
+0800]

request

"POST
/WarehousingServices/ProxyServices/RequestOrderDetails
HTTP/1.1“

status
bytes

200

1167


ELF = Extended Logging Format


Extended Logging Format Fields
Common
format
fields
Request
fields

date
cs-‐method

6me
cs-‐uri

bytes
cs-‐uri-‐stem

sc-‐status
cs-‐uri-‐query

Network
fields
The
Good
Stuff

c-‐ip
cs-‐comment

s-‐ip
6me-‐taken

c-‐dns
custom

s-‐dns


Server log files


####<2/08/2011
12:49:35
AM
EST>
<No6ce>
<Server>
<brother-‐eye>
<AdminServer>
<[ACTIVE]
ExecuteThread:
'0'
for
queue:

'weblogic.kernel.Default
(self-‐tuning)'>
<<WLS
Kernel>>
<>
<>
<1312210175933>
<BEA-‐002613>
<Channel
"Default"
is
now
listening
on

10.0.2.15:7001
for
protocols
iiop,
t3,
ldap,
snmp,
h:p.>

####<2/08/2011
12:49:35
AM
EST>
<No6ce>
<WebLogicServer>
<brother-‐eye>
<AdminServer>
<[ACTIVE]
ExecuteThread:
'0'
for
queue:

(self-‐tuning)'>
<<WLS
Kernel>>
<>
<>
<1312210175933>
<BEA-‐000331>
<Started
WebLogic
Admin
Server

"AdminServer"
for
domain
"example1030Domain"
running
in
Development
Mode>

Timestamp
Severity
Subsystem
Machine

<2/08/2011
12:49:35
AM
EST>
<Nodce>
<WebLogicServer>
<brother-‐eye>

Server
Thread
ID

<AdminServer>
<[ACTIVE]
ExecuteThread:
'0'
for
queue:

(self-‐tuning)'>

User
Txn
ID
Diagn.
Time
(msecs)
Message
ID
Text

<<WLS
Kernel>>
<>

<>
<1312210175933>
<BEA-‐002613>
<Channel
"Default"
is


Debug flags


HTTP:
weblogic.servlet.DebugH:p

SSL:

default.DebugSSL

JDBC:
weblogic.jdbc.sql.DebugJDBCSQL


<4/08/2011
07:47:35
PM
EST>
<Warning>
<netuix>
<BEA-‐423420>
<Redirect
is
executed
in
begin
or

refresh
ac6on.
Redirect
url
is
/console/console.portal?_nfpb=true&_pageLabel=HomePage1.>

Loaded
index.jsp
page

Loaded
index.jsp
page

Loaded
index.jsp
page

<4/08/2011
23:20:34
PM
EST>
<Info>
<Health>
<brother-‐eye>
<AdminServer>
<weblogic.GCMonitor>

<<anonymous>>
<>
<>
<1311830434630>
<BEA-‐310002>
<86%
of
the
total
memory
in
the
server
is
free>

TO

<4/08/2011
07:53:38
PM
EST>
<No6ce>
<WebLogicServer>
<BEA-‐000365>
<Server
state
changed
to

RUNNING>

<4/08/2011
07:53:38
PM
EST>
<No6ce>
<WebLogicServer>
<BEA-‐000360>
<Server
started
in
RUNNING

mode>

<4/08/2011
07:53:49
PM
EST>
<Nodce>
<Stdout>
<BEA-‐000000>
<Loaded
index.jsp
page>

<4/08/2011
07:53:50
PM
EST>
<Nodce>
<Stdout>
<BEA-‐000000>
<Loaded
index.jsp
page>

<4/08/2011
07:53:51
PM
EST>
<Nodce>
<Stdout>
<BEA-‐000000>
<Loaded
index.jsp
page>

<4/08/2011
08:20:34
PM
EST>
<Info>
<Health>
<brother-‐eye>
<AdminServer>
<weblogic.GCMonitor>

<<anonymous>>
<>
<>
<1311830434630>
<BEA-‐310002>
<86%
of
the
total
memory
in
the
server
is
free>


Oracle Service Bus tracing

JMS Message Logs


SOA Suite Diagnostic Logs


Case File #1
An Unbalanced Load

Sun
Reverse

WebLogic
Server

Proxy

Load
balancer

Sun
Reverse

WebLogic
Server

Proxy


cat
access.log*
|
awk
‘{
print
$x
}’
|
sort
|
uniq

(where
x
=
posi-on
of
the
cookie
in
the
log
ﬁle)


Case File #2
Fear Of Commitment

Oracle
Service
Bus

Tuxedo


Tools

Editors
Querying
data
Analysis

The
Gun
ﬁnd
Excel

vi
grep
R

sed
Splunk

awk

tail


@kapowe

kevinpowe

kapowe


Developer and Fusion Middleware 1 _ Kevin Powe _ Log files - a wealth of forensic evidence.pdf

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Andere mochten auch

Andere mochten auch (8)

Ähnlich wie Developer and Fusion Middleware 1 _ Kevin Powe _ Log files - a wealth of forensic evidence.pdf

Ähnlich wie Developer and Fusion Middleware 1 _ Kevin Powe _ Log files - a wealth of forensic evidence.pdf (20)

Mehr von InSync2011

Mehr von InSync2011 (20)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Developer and Fusion Middleware 1 _ Kevin Powe _ Log files - a wealth of forensic evidence.pdf