Slashdot Mirror
EFF's Logfinder
clonebarkins writes "EFF has just released a new software tool called "logfinder" to help server admins find (and delete) unnecessary log files on their boxen. "By finding unwanted log files, logfinder informs system administrators when their servers are collecting personal data and gives them the opportunity to turn logging off if it isn't gathering information necessary for administering the system.""
locate log
Windows
You wear wraparound sunglasses, even indoors. You wish your mother would let you ride a motorbike. You tell your friends you're pulling in $50,000 a year and $2,000 a month "playing the stock market" but in reality you're only bringing in half that and your dividends from MSFT havn't been good in years. Your non computing friends all turn to you for help; you only charge $30 an hour. Your collegues talk about you behind your back. Your workplace nickname is likely to be "The Asshole". Unlike the Linux fanboys, you actually try to pick up dates in bars but women laugh at you.
Apple
You think you're so cool you hurt. You have mirrors on every wall in your "loft apartment", which is really a grimy little apartment next to a guy who plays Guns 'n Roses at 3am. All of your furniture is from Ikea. You sometimes think that changing your name to "Steve" would be "pretty cool". When you go to bars you only drink Miller Lite. No body ever asks you for help with their computers because they know you don't know anything but OS X, even if you do tell them you "run Unix" now. Your friends openly laugh at you.
Linspire
You regularly give $10 bills to homeless guys because you have too much money. Computers baffle you, but you enjoy looking at pictures of naked women. You don't know what Linux is, but you continually bugged the IT guy at work about your computer so he installed Linspire on your machine.
Umbongo
You shop at GAP. You probably used to use a Mac. When you saw the multiracial image used as a desktop picture and heard that this operating system came from the same country as Nelson Mandella, you knew it was for you. You meet with your friends in fair-trade coffee houses and talk about the eventual overthrow of evil corporations such as Microsoft and Starbucks. Like the Linspire user, you have very little real knowlege when it comes to computers but you would never use your computer to look at pictures of women degrading themselves.
Gentoy
You've been "into computers" for ohh, one or two years now and fancy yourself as "a bit of a hacker". Wouldn't know C from C++, or even Perl for that matter. Older Gentoy users may be building their homes from matchsticks. You've explained to all your friends that your matchstick house will have an "optimised floorplan". They've tried to tell you that your house violates every known building code and law in your area, but you've ignored them so far because you can't read those complicated regulatory documents.
Linux From Scratch
Much like the Gentoy user but you'd also be into sadomasochistic sex if you could get it. You're not just building a house from matchsticks, you're planing to grow the trees to make the matchsticks. You've cleared some land but don't know what to do next because you havn't read the books you've got, so you've posted to alt.arborists.newbie asking for help. It's been three days so far and no one has replied. You remain hopeful.
it also gives intruders/managers/employees/anyone with something to hide the ability to search and remove incriminating logs. Thanks EFF!
-Teiresias
Now the question is, can this tool be used for evil? As in finding all the logs on the system and sending them to some script-kiddie?
---
Programming is like sex... Make one mistake and support it the rest of your life.
A competent admin will know that his/her boxen are collecting personal data. An ethical admin will get rid of any unneeded data.
LK
"Hi. This is my friend, Jack Shit, and you don't know him." - Lord Kano
Is the point of this that law enforcement can't subpoena records that don't exist?
500GB of disk, 5TB of transfer, $5.95/mo
I would seriously hope that:
a) the sysadmins are competent enough to handle this themselves. I would think that a sysadmin would know how to use some sort of local file search.
b) the EFF understands that it's not always up to the sysadmins to determine the amount of time to keep logs that might be used against an individual.
Most administrators already have effective methods of managing their logs. They crontab the hell out of it.
I think that partition which fills up due to logs getting out of hand is one of the primary causes for the system to start malfunctioning. It is funny, but it used to be better when file size was limited to 2 Gigs, so the log stopped growing when it hit that limit. This is not longer the case on more modern systems.
"You mortals are so obtuse." -Q
God forbid professional sysadmins should be expected to understand how their services are configured and what files are being written. If I were a user on one of their systems, sendmail log files would be the least of my concern.
What I'm listening to now on Pandora...
A new form of employee bribery in the making? Give me a raise or I will start blogging about all this idiotic stuff you do everyday to your customers and employees.
And now that I think about it, wouldn't it have been great to start quoting my boss that used to call his management team "the most ignorant SOB's on the face of the earth." Boy were we motivated by that.
Can I have a tool to locate and delete people who use the word 'boxen'? GPL preferably.
Am I behind the times in cool admin speak or was this simply boxes mispelled? In any case I could definitely see this being used for both good and bad.
News Reporters Make Tasty Polar Bear Treats!
DIR /S /A: HSA *.log
Wow -- amazing.
rather than letting the admin delete the logs, it instead automatically sent logs to the management.
I'm sorry, but this might just be the dumbest move yet they have made...
lots are crucial for many reasons:
1. Hacking attacks (how else do you track them, and prevent them)?
2. Abuse problems (spammers, credit card fraud)
3. aggregate statistics (what percentage of my customers are based in Europe?)
I can't see why someone would shoot themselves in the foot and use this.
Like log files are really intrusive anyway.
Interesting.. I run a small ISP, and this is something I never even considered. Gonna try it out right now. If there IS any personal data in a log file on my servers, I would consider the safety equal to the trust of me and my few fellow admins, however I can help but think... ROOT KIT!
Not that there aren't already ways to do this, but developers look out! I'm coming after your log files hidden in 25 subdirectories you insensitive jerks!
-The only sig I have is a cig
boxen is not a word.
--Chris http://chris.quietlife.net/
The last time I checked out redhat (about version 8 I rekon) they inluded this nice little utility called "logviewer". And, I though, wow a text viewer how novel, Linux doesnt have many text viewers.
So not only is this a text viewer, but it also finds all those logs hidden in /var/log/*, it must be hard to find anything in /var/log/* ...
This is just EFF's way of reminding sysadmins to be vigilent about their log files, it's not meant to replace good administration habits.
We must be in the dryest of tech news deserts for this to be worth /. news.
next there will be a report that a new tool to comb your hair has been developed, which looks suspiciously like a comb.
The article said, "unneccessary log files". It gives you the option of keeping ones you deem necessary. So 1-3 really are necessary log files.
Keep in mind, it also let's website owners that own less than honorable websites (porn!) to keep the users' privacy intact, so that the Patriot Act nazis don't needlessly go after private citizens.
My first thought was the main purpose of this would be to identify and eliminate "wasted" disk space. There are a bunch of logs that, without management, really just end up being wasted bits on your disk. Generally, that may be a useful utility, at least to me.
I was suprised to see the EFF seems to have a totally different motivation. It seems their real motivation is that the government can't demand logs that don't exists, or more specifically you can't get in trouble for not providing what you don't actually have.
Not sure what I think of that...
Soccer Goal Plans
This is like so 20 years ago...
find / - name *log*
-D
boxen as the plural of box is worth mentioning again.
Don't forget the tapes.
Actually, it uses lsof and a few other niceties to locate open files that change over time, then scans them for presence of time/date stamps, mailaddress or other "log" activity.
/var/log" either, but a bit more complex.
So, no, its not just "locate log" that somone suggested, nor is it "find
As for the comment about competent site-admin. This is a bit more than that too, its also about users and active software, peoples IRC logs, various ftp clients that clobber up and log passwords along with everything else in their config dir. And so on and so forth.
I didn't do this, now did I?
lead 7o 'cleaner
Around here, we call that "logrotate."
"No problem. I have the capacity to do infinite work so long as you don't mind that my quality approaches zero."-Dilbert
to take regular backups, then they shouldn't need the EFFs tool to wipe logs.
are you saying you don't stream your logs across the network/frame relay to another site where they are permanently stored and monitored by unrelated personnel? If you have seperate admin teams, make them in charge of other people's logs (and vice-versa). It's like a checks and balances system.
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
You could be treading in some dangerous territory. Let's say, for instance, as a sysadmin, you know one of your users has been accessing some machine they should not access for whatever reason (immoral, illegal, etc...). Well, you run this tool and uncover evidence to support that theory, then discuss with JaneUser and, out of the goodness of your heart, decide to remove the logs in question. All is well.
Two months later, "they" subpoena your logs to find no trace of evidence. Suspecting log-alteration, they subpoena the upstream providers logs and find correlating evidence that is mysteriously missing from your logs. So, JaneUser ends up getting in trouble, and the kind-hearted sysadmin gets slapped with evidence tampering.
I think, if you're going to carry out any activity that needs covering up, then you need to be more in tune with the circumstances rather than dealing with these sort of things after the fact. Or you could just avoid illegal activity all together...
I'm sorry, this reminds me of another recent story. I think the EFF is doing a lot of good things, but releasing this kind of agenda-pushing software does seem a bit strange to me.
EagerEyes.org: Visualization and Visual Communication
I can see how useful logfinder could be/is. And how it along with relevant administration, can eleviate the possibility that your systems are harbouring evidence of criminal activity... Could they seize any systems they deem necessary? I certainly wouldn't want any of my systems seized because I don't have a log retention policy, and hence when they ask do you have logs for such and such @ such and such a date, a reply of I'm not sure wouldn't go down too well! In short and IMHO having a log retention policy is a good idea... think I might recommend one myself.
"Quoting famous computer scientists out of context is the root of all evil (or at least most of it) in programming." - K
why not boxii?
it's just as stupid and incorrect.
Moderators, what are you smoking?
Two months later, "they" subpoena your logs to find no trace of evidence. Suspecting log-alteration, they subpoena the upstream providers logs and find correlating evidence that is mysteriously missing from your logs. So, JaneUser ends up getting in trouble, and the kind-hearted sysadmin gets slapped with evidence tampering.
How would it be "evidence tampering" if you didn't even know about the existence of an investigation until 2 months after you edited the logs? For you to be tampering with "evidence", doesn't there have to be a case existing at the time - an wouldn't you have to know about it?
If you mod me down, I shall become less powerful than you could possibly imagine.
This tool could be moderately useful, especially in an environment where the administrator can't be expected to know all of the ins and outs of third-party add-ons.
I was once assigned to a dotcom that used a third-party component to allow for credit card transactions. What the admin didn't realize was the default configuration left the component in debug mode, placing all user-submitted credit card data in plain text files on the web server
We only found the log file accidentally while performing an unrelated search for files modified in the last 'n' days. The admin relied on the developers to configure the third-party component and the developers were relying on another set of consultants who didn't know or didn't care about the log files.
90% of everything is crap. Also, crap is relative.
This system is rock solid, in use for hours/day with the exact same mix of programs running constantly (evolution, mozilla, ssh/rxvt windows to external systems, etc.)
comments?
Been there, done that, paid for the T-shirt
and didn't get it
No offence to the fact that almost all the comments under this thread are mocking it.... But even as a professional admin whom has worked on hosting envrionment servers for years, sometimes I run into problems from a log file getting out of hand that hadnt been properly managed etc... It's hard to know and find them sometimes and, :O this does ;P
what's a boxen?
...for my new r00t kit! Now I can upload this onto a machine to easily find all the sensitive logs to swipe and wipe. I'm gunna be a l33t hax0r. Yay me! (Now I just need to wait for a story about a new vunerability. This'll be kewl.)
If somebody could find me a device that would hunt down annyoing people who complain about improper pluralization among tech nerds, then I'd definitely pay for that.
:-)
"Boxen" is fine. If the plural of ox is oxen, then pluralizing box as boxen seems perfectly acceptable to me. It also helps to understand that somebody is talking about a bunch of computers as opposed to a bunch of cardboard boxes.
But I swear that the next person who tells me (in person) that virii is not correct is getting a punch in the face. I mean it.
- Give a man a fire and he's warm for a day, but set him on fire and he's warm for the rest of his life.
See my above comment.
Did the EFF just beat Google to the punch on a "Server Search" app?
What language is that? I always thought boxes was the plural of box.
Mod up.
In reply to your sig ("What if Goat-boy and Tub-girl had offspring?"), the answer is "We'd be in deep shit.".
And yes, you are seriously behind the the times. The oldest copy of the Jargon File I have is from the early '90s and that contains the word boxen
Well, maybe he's so behind the actually he's ahead. I don't know anyone but lamer kiddies and old farts trying desperately to be hip that really use the phrase anymore. It's almost as if it's become a marketing buzz word, and if you know anyone who uses it frequently to refer to computers is probably reaching out for acceptance or hoping that you'll think they're clever. Over reaching.
When I hear someone use the word boxen, my first thought is "wannabee".
It's not offtopic, dumbass. It's orthogonal.