Tag: monitoring

Centrally Monitoring Windows NT/2000/XP/2003

Monitoring Windows NT/2000/XP/2003 is important even for small environments. Automatically monitored, critical failures can often be avoided. But how to monitor a system without too much effort? The basic idea behind a successful monitoring and alerting system is to centralize all system events at a single monitoring station. Once the information is centralized, it can be used to build an alerting system or even carry out corrective actions.

Monitoring File or Directory Changes

Many modern systems provide a way to watch a directory for events (new files, reading the directory, modification of a file in the directory, etc.). This facility can be done in various ways, from providing hooks in the filesystem code itself to something that watches for inode changes. Linux and BSD have several possibilities in that regard, including dnotify, changedfiles, and watch.

Saving Our Bacon: Snort Security Holes and Strategies for Safe Network Monitoring

In April, a CERT advisory announced the discovery of two separate buffer-overflow vulnerabilities in Snort, a popular security-monitoring tool used for detecting suspicious network activities. This development was disturbing and ironic: system administrators install and run programs like Snort to improve security, and don’t often consider the possibility that the tools themselves might be attacked and exploited to create entirely new security holes. It’s therefore important to understand precisely what happened here, especially since the same mechanisms used against Snort could threaten other security tools.

Back To Top