loggint through syslog

[Ryan Malayter]

On Thursday, December 17, 2009, merlin corey <merlincorey at dc949.org> wrote:
> Many log analyzers work fine with multiple files from multiple
> sources, at least I know analog does.  Failing that, you could write a
> script to aggregate the logs...

I think a more important use case for syslog is enabling
tamper-resistant logs to another system. Syslog over IPSec to an
unrelated system is a lot more confidence inspiring to security folks
than a local text file that can be modified after a breach.


-- 
RPM