Good sarc monitoring tip



Sarc is still in their month of security tips per day and todays is another good one. Todays tip is about monitoring machines, particularly those that “defend” your network. (Mail antivirus scanners/ proxy fitlers/scanners/etc.) The core of the advice is to not just ping – that only tells you if the system exists and is online – it doesn’t tell if things are working. They suggest scripting tests (antivirus scanner can be tested via the EICAR test signature for instance.) They note that doesn’t tell if the av scanner is updated (I prefer a crontab output of the days updates – looks like there were around 9 clamav signature updates yesterday.


I know, some of you are thinking, but I don’t want that much mail everyday. If you’re using a linux based system for monitoring you can script things in a number of ways. You can have the monitoring continually running and not contact you unless there’s a problem. (I have a tendency to use temporary files to hold the status of a service and then compare current results of a check to the last (in the temporary file) if the status has changed it will let me know, if all is the same I won’t be pestered by continual messages.) The only problem with this approach is if you start tuning out the messages because they’re too frequent. (That’s why it’s useful to improve your scripts to only notify you of changes.)

Related Posts

Blog Traffic Exchange Related Posts
  • Linspire's Click n run is now free First, Linspire released the freely available "freespire" release of their operating system (based on debian linux). Now, users will no longer have to pay an annual subscription for the click n run service. That's now available for free as well. There is a writeup here. Previously the annual subscription fees......
  • Linux network worm... There is a linux network worm (virus) in the wild, which I've mentioned already in an earlier post. I did want to take a few moments to highlight this and dispell a few myths. (This is the first linux virus I recall seeing over at SARC in the last couple......
  • Zotob update There was an update at Incidents.org on the Zotob worm and specifically an advisory related to Cisco products. From their site.... **snipped from NISCC** "Affected Products ================= If the software versions or configuration information are provided, then only those combinations are vulnerable. This is a list of appliance software that......
Blog Traffic Exchange Related Websites
  • Two Aspects of Social Media Marketing Every Business Needs There are a lot of different types of social media marketing out there. And as I've said before, there is no "one size fits all" social media. Your social media campaign must be planned according to your business, products, services, and your customers or clients. However, there are two kinds......
  • Principles of Good SEO for Your Blog Regardless of whether you are writing a blog simply because you enjoy having a lot of people reading your thoughts, or if you are writing a blog because you are looking to generate income, one of the most important things that you need to do is maximize the SEO or......
  • free SANS webcasts powered by vLive! The SANS Institute <Webcast@sans.org wrote: Please join us in the upcoming weeks for the following informative, free SANS webcasts powered by vLive!, the SANS Institute's online learning platform: WEBCAST 1 Internet Storm Center: Threat Update WHEN: Wednesday, May 11, 2011 at 1:00 PM ET (1700 UTC/GMT) FEATURING: Johannes Ullrich https://www.sans.org/webcasts/isc-threat-update-20110511-94088......
PDF24    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site