Re: periodic security run output gives false positives after 1 year

2012-02-20 Thread Gary Palmer
On Thu, Feb 16, 2012 at 02:01:24PM -0500, Glen Barber wrote: On Thu, Feb 16, 2012 at 06:59:54PM +0100, Miroslav Lachman wrote: Glen Barber wrote: On Thu, Feb 16, 2012 at 06:04:34PM +0100, Miroslav Lachman wrote: Hi, I see it many times before, but never take a time to post about it.

Re: periodic security run output gives false positives after 1 year

2012-02-20 Thread Dag-Erling Smørgrav
Miroslav Lachman 000.f...@quip.cz writes: I did a quick test where I changed Feb 15 01:52:06 to 2012-02-15 01:52:06 format. The correct format is 2012-02-20T01:23:45.6789+01:00 DES -- Dag-Erling Smørgrav - d...@des.no ___

Re: periodic security run output gives false positives after 1 year

2012-02-20 Thread Roger Marquis
The correct format is 2012-02-20T01:23:45.6789+01:00 You guys are aware that RFC 5424 is a proposed standard I trust? By being proposed it is not a standard, at least not yet. Perhaps the differences in human-readability of the proposed timestamp, or the fact that it has variable field types

Re: periodic security run output gives false positives after 1 year

2012-02-20 Thread Miroslav Lachman
Gary Palmer wrote: On Thu, Feb 16, 2012 at 02:01:24PM -0500, Glen Barber wrote: On Thu, Feb 16, 2012 at 06:59:54PM +0100, Miroslav Lachman wrote: Glen Barber wrote: On Thu, Feb 16, 2012 at 06:04:34PM +0100, Miroslav Lachman wrote: Hi, I see it many times before, but never take a time to

Re: periodic security run output gives false positives after 1 year

2012-02-19 Thread Martin Schütte
On 17.02.2012 20:48, Roger Marquis wrote: and difficult to change without breaking more than it fixes. The current syslog syntax timestamp has been reliable now for what, 25+ years? I don't personally see any measurable ROI from changing it. YMMV of course. I really understand the concern,

Re: periodic security run output gives false positives after 1 year

2012-02-18 Thread Robert Simmons
On Fri, Feb 17, 2012 at 6:56 PM, Roger Marquis marq...@roble.com wrote: I don't personally recall a time when everything else wasn't logging the year, in one format or another.  That's not to imply that syslogs shouldn't be distinguishable by year but the question seems to be where the year

Re: periodic security run output gives false positives after 1 year

2012-02-18 Thread Jason Hellenthal
On Sat, Feb 18, 2012 at 04:35:20PM -0500, Robert Simmons wrote: On Fri, Feb 17, 2012 at 6:56 PM, Roger Marquis marq...@roble.com wrote: I don't personally recall a time when everything else wasn't logging the year, in one format or another.  That's not to imply that syslogs shouldn't be

Re: periodic security run output gives false positives after 1 year

2012-02-17 Thread Miroslav Lachman
I re-add list to CC. Gregory Orange wrote: Hi Miroslav, I don't know if this message really contributes anything to the list, so I'll email you directly. On 17/02/12 01:04, Miroslav Lachman wrote: I see it many times before, but never take a time to post about it. Well, thank you for

Re: periodic security run output gives false positives after 1 year

2012-02-17 Thread Martin Schütte
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 02/16/2012 08:08 PM, Sergey Kandaurov wrote: 5424 yet. Almost complete implementation was done in NetBSD in that regard in 2008. NetBSD before RFC 5424 changes has had pretty similar syslogd source, so if one could analyze and port that changes

Re: periodic security run output gives false positives after 1 year

2012-02-17 Thread Roger Marquis
Sergey Kandaurov wrote: In IETF this RFC is marked obsolete and replaced with RFC 5424 with different timestamp format in ISO 8601 form. FreeBSD doesn't implement 5424 yet. Almost complete implementation was done in NetBSD in that regard in 2008. NetBSD before RFC 5424 changes has had pretty

Re: periodic security run output gives false positives after 1 year

2012-02-17 Thread Mike Kelly
So, can't you just do this? 1) Make it an option. 2) If it isn't set, keep the output like it is now. 3) Set it by default in new installs, with a comment above it that it might break things. That way people upgrading get a warning, too, and can keep it the way it has been if they'd like. On

Re: periodic security run output gives false positives after 1 year

2012-02-17 Thread Roger Marquis
1) Make it an option. 2) If it isn't set, keep the output like it is now. 3) Set it by default in new installs, with a comment above it that it might break things. That way people upgrading get a warning, too, and can keep it the way it has been if they'd like. You can, but it'd be like

periodic security run output gives false positives after 1 year

2012-02-16 Thread Miroslav Lachman
Hi, I see it many times before, but never take a time to post about it. Scrips in /etc/periodic are grepping logs for yesterday date, but without specifying year (because some logs do not have year logged). This results in false positive alerts in security e-mails from our lightly loaded

Re: periodic security run output gives false positives after 1 year

2012-02-16 Thread Glen Barber
On Thu, Feb 16, 2012 at 06:04:34PM +0100, Miroslav Lachman wrote: Hi, I see it many times before, but never take a time to post about it. Scrips in /etc/periodic are grepping logs for yesterday date, but without specifying year (because some logs do not have year logged). This results

Re: periodic security run output gives false positives after 1 year

2012-02-16 Thread Miroslav Lachman
Glen Barber wrote: On Thu, Feb 16, 2012 at 06:04:34PM +0100, Miroslav Lachman wrote: Hi, I see it many times before, but never take a time to post about it. Scrips in /etc/periodic are grepping logs for yesterday date, but without specifying year (because some logs do not have year logged).

Re: periodic security run output gives false positives after 1 year

2012-02-16 Thread Glen Barber
On Thu, Feb 16, 2012 at 06:59:54PM +0100, Miroslav Lachman wrote: Glen Barber wrote: On Thu, Feb 16, 2012 at 06:04:34PM +0100, Miroslav Lachman wrote: Hi, I see it many times before, but never take a time to post about it. Scrips in /etc/periodic are grepping logs for yesterday date,