Recommendations for Log File Monitoring

CA SystemEDGE User Guide › Log File Monitoring › Recommendations for Log File Monitoring

Recommendations for Log File Monitoring

You can monitor system and application logs to obtain in-depth information about user, system, and application behavior.

The following tables describe recommendations for log files you can monitor and the regular expressions for which you can search for monitoring security, device failures, system capacity, Windows security, and applications and systems:

Description	Log File to Monitor	Regular Expression
WARNING - daemon core	/var/log/daemon-log	core dumped
WARNING - daemon core	/var/log/syslog	core dumped
Monitor SU attempts	/var/adm/messages	su.*fail
Monitor rlogins	/var/log/syslog	in.rlogin
Monitor telnets	/var/log/syslog	in.telnet
Monitor rsh	/var/log/syslog	in.rsh
WARNING - Illegal Instruction, Daemon	/var/log/daemon-log	.llegal.nstruction
Spam Relay Attempt	/var/log/syslog	Relaying denied
Monitor DENY packets from a Linux firewall	/var/log/messages	DENY

Note: The log files described in this section are not the same for all operating systems. These examples are provided for reference. You should alter them for your operating system.

The following table describes the recommendations for regular expressions for which you can search in the syslog (/var/adm/messages) to monitor for device failures:

Description	Regular Expression
Critical: Badtrap Error	.BAD TRAP.
Error: SCSI error	.SCSI.[E,e]rror.*
Error: SCSI error	.SCSI.failed.*
Error: SCSI error	.SCSI.hung.*
Critical: badsimms error	.SIMM.
Critical: badsimms error	.BAD.SIMM.*
Critical: memory error	.[M,m]emory [E,e]rror.
Error: disk error	.disk not responding.
Error: disk error	.[D,d]isk.[E,e]rror.*
'Warning: disk fragmentation error'	.optimization changed.
Error: disk error	.corrupt label.
Error: I/O error	.I/O.[E,e]rror.*
Error: disk read/write errors	.Error for Command:.[read,write].*
Error: media error	.Media Error.
Info: serialport error	.zs[0,1,2]: silo overflow.
Warning: carrier error	.no carrier.
Warning: link is down	.Link Down - cable problem?.
Error: SDS error	.[NOTICE,WARNING,PANIC]: md:.

The following table describes recommendations for regular expressions for which you can search in /var/adm/messages to monitor system capacity:

Description	Regular Expression
Critical: memory error	[O,o]ut of [M,m]emory.
Critical: memory error	.[F,f]ile system full.
Error: diskspace error	.No space left on device.

The following table describes recommendations for which logs and expressions you can monitor in the Windows event logs to monitor Windows security:

Description	Event Log	Security Type	Regular Expression
Random Password Hack	Security	All	.*bad
Misuse of Privileges	Security	All	.*[user rights,group management,security change, restart,shutdown]
Improper File Access	Security	Failure	.*[read,write]
Improper Printer Access	Security	Failure	.*print
Virus Outbreak Warning: program files updated	Security	All	.write.[exe,dll,com]
Security Policies Change	Application	Information	.*[S,s]ecurity policy

The following table describes recommendations for which logs and expressions you can monitor in the Windows event logs to monitor applications and systems:

Description	Event Log	Security Type	Regular Expression
Application Error or Failure	Application	All	.[F,f]ail\|.[E,e]rror
Application Load Problems	Application	All	.[L,l]oad.[P,p]roblem
New Software Installed	Application	All	.*[INSTALL,Install,install]
Server Process failed during Initialization	Application	All	.*4131
Disk Failures and errors	All	All	.*[D,d]isk
Network Adapter Errors	All	Error	.*[N,n]etwork [A,a]dapter