Logs: What to check and where to find them?

Swakoo · 01-11-2006, 01:20 PM

Recently, my servers suffered a "DoS". I quoted it because it was caused by us, maxing our given bandwidth... but here's the interesting thing:

Our servers, throughout the 6hours "blackout", recorded low load (via 'top')

I checked /var/log/messages in some of the servers but didn't register much info from there.... and this has always been something that puzzle me.. where else should i look when it comes to tracing problem? What log shows what... what show I know... what should i look out first etc.. is there some kind of a "logs bible"?

I'm using Redhat, RHEL3 & 4 and FC4 mostly.

Would appreciate some guidiance here.

Many thanks!

saman007uk · 01-11-2006, 03:18 PM

I would recommend using something like LogCheck, which checks your logs for suspicious activity such as failed logins, etc.

A DDOS attack does not need to grind your machine to a halt, but rather use all of your available bandwidth - so that geniuine users will have a leesser chance of accessing the server.

Swakoo · 01-12-2006, 03:35 AM

Quote:

Originally Posted by saman007uk

I would recommend using something like LogCheck, which checks your logs for suspicious activity such as failed logins, etc.

A DDOS attack does not need to grind your machine to a halt, but rather use all of your available bandwidth - so that geniuine users will have a leesser chance of accessing the server.

How do I identify if it is a possible DDOS?

Our datacentre say our traffic pattern don't suggest it is a DDOS