Application Logging Good Bad Ugly ... Beautiful?

Application Logging “Worst Practices” Dr Anton Chuvakin, GCIA, GCIH, GCFA Chief Logging Evangelist LogLogic, Inc

Outline ,[object Object],[object Object],[object Object],[object Object]

Log Data Overview ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],What logs? From Where?

“ Standard” Messages 10/09/200317:42:57,10.10.94.13,48352,10.10.97.14,909,,,accept,tcp,,,,909,10.10.93.29,,0,,4,3,,' 9Oct2003 17:42:57,accept,labcpngfp3,inbound,eth2c0,0,VPN-1 & FireWall-1,product=VPN-1 & FireWall-1[db_tag={0DE0E532-EEA0-11D7-BDFC-927F5D1DECEC};mgmt= labcpngfp3;date=1064415722;policy_name= Standard],labdragon,48352,10.10.97.14,909, tcp,10.10.93.145,',eth2c0,inbound Oct 9 16:29:49 [10.10.94.4] Oct 09 2003 16:44:50: %PIX-6-302013: Built outbound TCP connection 2245701 for outside:10.10.98.67/1487 (10.10.98.67/1487) to inside:10.10.94.13/42562 (10.10.93.145/42562) PIX 2003-10-20|15:25:52|dragonapp-nids|TCP-SCAN|10.10.94.10|10.10.94.13|0|0|X|------S-|0|total=484,min=1,max=1024,up=246,down=237,flags=------S-,Oct20-15:25:34,Oct20-15:25:52| Oct 20 15:35:08 labsnort snort: [1:1421:2] SNMP AgentX/tcp request [Classification: Attempted Information Leak] [Priority: 2]: {TCP} 10.10.94.10:43355 -> 10.10.94.13:705 SENSORDATAID="138715" SENSORNAME="10.10.94.23:network_sensor_1" ALERTID="QPQVIOAJKBNC6OONK6FTNLLESZ" LOCALTIMEZONEOFFSET="14400" ALERTNAME="pcAnywhere_Probe“ ALERTDATETIME="2003-10-20 19:35:21.0" SRCADDRESSNAME="10.10.94.10" SOURCEPORT="42444" INTRUDERPORT="42444" DESTADDRESSNAME="10.10.94.13" VICTIMPORT="5631" ALERTCOUNT="1" ALERTPRIORITY="3" PRODUCTID="3" PROTOCOLID="6" REASON="RSTsent"

What Commonly “Gets Logged”? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Why Logs? What Are They Good For? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Why NOT Log? Why Logs Are Baaaaaaad!  ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Two Log Realms – And A Chasm In Between! ,[object Object]

In Detail: Audit vs Debug Logs Not known Known in advance Scope Might come handy (but debugger is better …) Slow down systems, clutter disk, unclear purpose, hard to update – yuck!  Developer view Useful for hours/days Useful for years Time scope Faults, failures, errors Attacks, activities, faults Content Sometimes on Always on Condition System operator, developer Security, audit Primary “consumer” Debug Logs Audit Logs

Result? ,[object Object],[object Object],[object Object],[object Object]

More results? ,[object Object],[object Object],[object Object],[object Object],[object Object]

Categorizing Log Badness - I ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Categorizing Log Badness - II ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

But This … This Here Takes The Cake … ,[object Object],[object Object],[object Object]

Alien (logging) vs Predator (performance) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

On The Other Hand, Best Logs … ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

So, How to Change That?! ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Brief “Treatise” On What To Log - Events ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Brief “Treatise” On What To Log – Core Details ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Brief “Treatise” On What To Log – Context ,[object Object],[object Object],[object Object]

Brief “Treatise” On How To Log ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Who Will Do This? Inside Your Organization ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Who Will Do This? Outside Your Organization ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Mini-conclusion ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Thank You for Attending! ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Application Logging Good Bad Ugly ... Beautiful?

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (19)

Similar to Application Logging Good Bad Ugly ... Beautiful?

Similar to Application Logging Good Bad Ugly ... Beautiful? (20)

More from Anton Chuvakin

More from Anton Chuvakin (20)

Recently uploaded

Recently uploaded (20)

Application Logging Good Bad Ugly ... Beautiful?