Slashdot Mirror
EFF's Logfinder
clonebarkins writes "EFF has just released a new software tool called "logfinder" to help server admins find (and delete) unnecessary log files on their boxen. "By finding unwanted log files, logfinder informs system administrators when their servers are collecting personal data and gives them the opportunity to turn logging off if it isn't gathering information necessary for administering the system.""
locate log
it also gives intruders/managers/employees/anyone with something to hide the ability to search and remove incriminating logs. Thanks EFF!
-Teiresias
A competent admin will know that his/her boxen are collecting personal data. An ethical admin will get rid of any unneeded data.
LK
"Hi. This is my friend, Jack Shit, and you don't know him." - Lord Kano
Is the point of this that law enforcement can't subpoena records that don't exist?
500GB of disk, 5TB of transfer, $5.95/mo
I would seriously hope that:
a) the sysadmins are competent enough to handle this themselves. I would think that a sysadmin would know how to use some sort of local file search.
b) the EFF understands that it's not always up to the sysadmins to determine the amount of time to keep logs that might be used against an individual.
Most administrators already have effective methods of managing their logs. They crontab the hell out of it.
God forbid professional sysadmins should be expected to understand how their services are configured and what files are being written. If I were a user on one of their systems, sendmail log files would be the least of my concern.
What I'm listening to now on Pandora...
Can I have a tool to locate and delete people who use the word 'boxen'? GPL preferably.
Am I behind the times in cool admin speak or was this simply boxes mispelled? In any case I could definitely see this being used for both good and bad.
News Reporters Make Tasty Polar Bear Treats!
rather than letting the admin delete the logs, it instead automatically sent logs to the management.
I'm sorry, but this might just be the dumbest move yet they have made...
lots are crucial for many reasons:
1. Hacking attacks (how else do you track them, and prevent them)?
2. Abuse problems (spammers, credit card fraud)
3. aggregate statistics (what percentage of my customers are based in Europe?)
I can't see why someone would shoot themselves in the foot and use this.
Like log files are really intrusive anyway.
The last time I checked out redhat (about version 8 I rekon) they inluded this nice little utility called "logviewer". And, I though, wow a text viewer how novel, Linux doesnt have many text viewers.
So not only is this a text viewer, but it also finds all those logs hidden in /var/log/*, it must be hard to find anything in /var/log/* ...
This is just EFF's way of reminding sysadmins to be vigilent about their log files, it's not meant to replace good administration habits.
My first thought was the main purpose of this would be to identify and eliminate "wasted" disk space. There are a bunch of logs that, without management, really just end up being wasted bits on your disk. Generally, that may be a useful utility, at least to me.
I was suprised to see the EFF seems to have a totally different motivation. It seems their real motivation is that the government can't demand logs that don't exists, or more specifically you can't get in trouble for not providing what you don't actually have.
Not sure what I think of that...
Soccer Goal Plans
Umm, that's where logrotate is for. Yeah I know, there are some stupid vendors who don't support this out of the box, but it's not difficult to make it work with a random application.
As a sidenote, this should be modded 'clueless', not 'informative'.
8 of 13 people found this answer helpful. Did you?
Just two observations: (the second of which is actually relevant to this parent)
1. It took me around 3 minutes to find out that this thread applies to POSIX-like systems only (ie. won't work on this winXP). The fact should really have been mentionned in the summary. I only say this because recently, some summaries seem to have been "hastily" written.
2. I am myself wary of huge, hidden log files that either winXP itself or other programs create. As the only user and sysadmin on this system and keen to minimise disk wastage, I would want to prune all logs regularly. Trouble is, they aren't all *.log files. So, how do I find them, short of going through every single program and investigating any logs it might or might not create?
Actually, it uses lsof and a few other niceties to locate open files that change over time, then scans them for presence of time/date stamps, mailaddress or other "log" activity.
/var/log" either, but a bit more complex.
So, no, its not just "locate log" that somone suggested, nor is it "find
As for the comment about competent site-admin. This is a bit more than that too, its also about users and active software, peoples IRC logs, various ftp clients that clobber up and log passwords along with everything else in their config dir. And so on and so forth.
I didn't do this, now did I?
Around here, we call that "logrotate."
"No problem. I have the capacity to do infinite work so long as you don't mind that my quality approaches zero."-Dilbert
to take regular backups, then they shouldn't need the EFFs tool to wipe logs.
are you saying you don't stream your logs across the network/frame relay to another site where they are permanently stored and monitored by unrelated personnel? If you have seperate admin teams, make them in charge of other people's logs (and vice-versa). It's like a checks and balances system.
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
You could be treading in some dangerous territory. Let's say, for instance, as a sysadmin, you know one of your users has been accessing some machine they should not access for whatever reason (immoral, illegal, etc...). Well, you run this tool and uncover evidence to support that theory, then discuss with JaneUser and, out of the goodness of your heart, decide to remove the logs in question. All is well.
Two months later, "they" subpoena your logs to find no trace of evidence. Suspecting log-alteration, they subpoena the upstream providers logs and find correlating evidence that is mysteriously missing from your logs. So, JaneUser ends up getting in trouble, and the kind-hearted sysadmin gets slapped with evidence tampering.
I think, if you're going to carry out any activity that needs covering up, then you need to be more in tune with the circumstances rather than dealing with these sort of things after the fact. Or you could just avoid illegal activity all together...
I'm sorry, this reminds me of another recent story. I think the EFF is doing a lot of good things, but releasing this kind of agenda-pushing software does seem a bit strange to me.
EagerEyes.org: Visualization and Visual Communication
I can see how useful logfinder could be/is. And how it along with relevant administration, can eleviate the possibility that your systems are harbouring evidence of criminal activity... Could they seize any systems they deem necessary? I certainly wouldn't want any of my systems seized because I don't have a log retention policy, and hence when they ask do you have logs for such and such @ such and such a date, a reply of I'm not sure wouldn't go down too well! In short and IMHO having a log retention policy is a good idea... think I might recommend one myself.
do a search for big files (>1gig) on your disk that are not audio/video files.
Any tool could probably be used for evil. For instance I have a calendar on my wall. If I took it down and rolled it up, I could probably beat you half way to death with enough strong blows.
"Quoting famous computer scientists out of context is the root of all evil (or at least most of it) in programming." - K
That's why you use a tape backup tool that has an "Enron/Anderson" mode. Before writing any file to tape, encrypt it with a random key and store that key in you file locator database. Then when it is time to expire a particular file version, all you have to do is delete the index record. No need to wipe the tape. This is useful if you have data on a tape that expires at different times.
Also, for security, the random keys should then be passed through a public key encryption prior to being written to the database.
Boxes is a perfectly adequate plural form. Also on principle I dislike "boxen" because of its widespread use in leet speak.
Two months later, "they" subpoena your logs to find no trace of evidence. Suspecting log-alteration, they subpoena the upstream providers logs and find correlating evidence that is mysteriously missing from your logs. So, JaneUser ends up getting in trouble, and the kind-hearted sysadmin gets slapped with evidence tampering.
How would it be "evidence tampering" if you didn't even know about the existence of an investigation until 2 months after you edited the logs? For you to be tampering with "evidence", doesn't there have to be a case existing at the time - an wouldn't you have to know about it?
If you mod me down, I shall become less powerful than you could possibly imagine.
This tool could be moderately useful, especially in an environment where the administrator can't be expected to know all of the ins and outs of third-party add-ons.
I was once assigned to a dotcom that used a third-party component to allow for credit card transactions. What the admin didn't realize was the default configuration left the component in debug mode, placing all user-submitted credit card data in plain text files on the web server
We only found the log file accidentally while performing an unrelated search for files modified in the last 'n' days. The admin relied on the developers to configure the third-party component and the developers were relying on another set of consultants who didn't know or didn't care about the log files.
90% of everything is crap. Also, crap is relative.
Just reinstall XP every week. You probably need to anyway to keep it running well.
Just because it CAN be done, doesn't mean it should!
This system is rock solid, in use for hours/day with the exact same mix of programs running constantly (evolution, mozilla, ssh/rxvt windows to external systems, etc.)
comments?
Been there, done that, paid for the T-shirt
and didn't get it
No offence to the fact that almost all the comments under this thread are mocking it.... But even as a professional admin whom has worked on hosting envrionment servers for years, sometimes I run into problems from a log file getting out of hand that hadnt been properly managed etc... It's hard to know and find them sometimes and, :O this does ;P
Don't want to accuse you of having your own agenda (*cough* Mr. lin ux.com *cough*), but reinstalling every week would seem to be a little extreme. XP may have vulnerabilities, and may not be as stable as Linux servers in the long run, but a properly configured XP box is relatively stable. Add in the requisite free software (firewall, malware catchers, et al: www.pcw orld.com/reviews/article/0,aid,116456,00.asp), and even if it's not as secure as Linux, it should still not need to be re-ghosted every 3 months, let alone every week.
Seriously, has anyone who uses XP, on a regular basis, had a situation where they felt it necessary to reinstall weekly? I'd like to hear, if so ... if only to know what to look out for.
...for my new r00t kit! Now I can upload this onto a machine to easily find all the sensitive logs to swipe and wipe. I'm gunna be a l33t hax0r. Yay me! (Now I just need to wait for a story about a new vunerability. This'll be kewl.)
If somebody could find me a device that would hunt down annyoing people who complain about improper pluralization among tech nerds, then I'd definitely pay for that.
:-)
"Boxen" is fine. If the plural of ox is oxen, then pluralizing box as boxen seems perfectly acceptable to me. It also helps to understand that somebody is talking about a bunch of computers as opposed to a bunch of cardboard boxes.
But I swear that the next person who tells me (in person) that virii is not correct is getting a punch in the face. I mean it.
- Give a man a fire and he's warm for a day, but set him on fire and he's warm for the rest of his life.
See my above comment.
Did the EFF just beat Google to the punch on a "Server Search" app?
What's with database backups, genius?
And yes, you are seriously behind the the times. The oldest copy of the Jargon File I have is from the early '90s and that contains the word boxen
Well, maybe he's so behind the actually he's ahead. I don't know anyone but lamer kiddies and old farts trying desperately to be hip that really use the phrase anymore. It's almost as if it's become a marketing buzz word, and if you know anyone who uses it frequently to refer to computers is probably reaching out for acceptance or hoping that you'll think they're clever. Over reaching.
When I hear someone use the word boxen, my first thought is "wannabee".
It's not offtopic, dumbass. It's orthogonal.