Mastering Python Networking

The syslog search

There are plenty of documented network security breaches that took place over an extended period of time. In these slow breaches, often times evidence indicates that there were signs and traces in both the server and network logs that indicates suspicious activities. The undetected activities were not detected not because there was a lack of information, but rather there are too much information. The critical information that we were looking for are usually buried deep in a mountain of information that are hard to sort out.

Besides syslog, Uncomplicated Firewall (UFW) is another great source of log information for servers. It is a frontend to iptable, which is a server firewall. UFW makes managing firewall rules very simple ...