AFAIK, LogWithRaw is the only convenient way to see raw packet data of event. In this case raw packet data will bw stored in DB and can be viewed in event details. Please, if someone has something to add to my explanation about LogWithRaw, inform me, because this parameter is very poor descrabed in docs and student's guides.
I tried to use this for analysis of IM activities, LDAP sessions, etc, where user credentials are transferred in clear text. But I'd found that after changing LOGDB form LogWithoutRow to LogWithRaw these events had stopped to be shown in SP Console. I could see events with LogWithRaw switched on in Event Viewer, but not in Console. Can someone help me to understand what's the problem? Another question is for ISS or somebody who knows ISS's future plans. Does ISS plan to realize storage of evidence in DB? Because in current implementation LogEvidence feature almost useless, because it's completely impossible to find needed evidence for desired event, especially in case when number of events have Log Evidence switched on. I wrote about this on [EMAIL PROTECTED], but I don't knoe the fate of that letter. Thanks. --- Best regards, Sergey V. Soldatov. Information security department. tel/fax +7 095 745 89 50 (1613) _______________________________________________ ISSForum mailing list [email protected] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
