Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Received-SPF: pass (nike.apache.org: domain of nbelk@nitrosecurity.com
 designates 67.192.241.155 as permitted sender)
Message-ID: <4CF983B6.7080108@nitrosecurity.com>
Date: Fri, 03 Dec 2010 16:56:38 -0700
From: Nathan Belk <nbelk@nitrosecurity.com>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US;
 rv:1.9.2.12) Gecko/20101027 Thunderbird/3.1.6
MIME-Version: 1.0
To: "users@httpd.apache.org" <users@httpd.apache.org>
References: <1313150932.2036.1291418823509.JavaMail.root@iris>
In-Reply-To: <1313150932.2036.1291418823509.JavaMail.root@iris>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Subject: Re: [users@httpd] Request for Log samples

Thanks for the reply.

The rule sets are not for our environment per se.  We create the rules 
and signatures that go onto the NitroSecurity SIEM products.  These 
products then are placed on customers' networks which helps keep their 
systems secure.


All the apache installations that we have in house are test 
installations that do not see much traffic.  What we are looking for are 
log files as close to real world log samples as possible so that the 
rule-set will cover a wide range of events that our customers may encounter.

I understand that there may be sensitive information contained in the 
error and access logs.  I was not expecting these people would send me 
their logs.  I was just writing to see if anyone has any logs they 
wouldn't mind sharing with me so that I might create a more robust set 
of rules.

Thanks!

Nathan

On 12/03/2010 04:27 PM, Igor Galić wrote:
> Hi Nathan,
>
>> I am currently working on creating signatures and rules to collect
>> events from the Apache web server.  I am doing this so that
>> NitroSecurity can support the Apache web server with the Nitroview
>> SIEM
>> product line.
>>
>> To accomplish this, I need as many log samples that I can find of both
>> the error log and the access log.  With the access log, I am looking
>> for the combined and common log formats.
>>
>> I have looked for log samples on line but I generally only find
>> generic
>> single line examples.  I am looking for larger log files of the apache
>> server in production so that I may create a more complete collection
>> of rules.
> Access and Error Log files often contain quite sensitive information,
> so hardly anyone (sane) will be very keen on sharing them.
>
>> If you are able to, please send your log files to me at
>> nbelk@nitrosecurity.com
> Why can you not use your own log files?
> For *your* environment, they should make most sense.
>
>> Thanks,
>>
>> Nathan
> i
>


---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org