| devialog - Syslog Anomaly Detection |
|---|
|
What kind of performance can I expect?
On an 800mhz intel system, with a signature base of roughly 1500, expect the ability to parse over 200 syslog lines per second. Some of the larger syslog servers I've come across do not come close to this capacity. If your syslog server does, please let me know.
The signatures file contains the .pl extension to help out editors with proper syntax highlighting. Since the signatures are in perl hash format, syntax highlighting will help out those unfamiliar with perl and ensure there are no errors within the format. You do not need to execute the signatures file.
Aside from a manual inspection with a text editor that has a syntax highlighting function, the following command ensures they are in the proper format:
$ perl -c signatures.pl
You should receive this result provided there are no errors within the signature file.
What does it mean when signatures.pl does not return a true value?
This is a result of a blank or nonexistent signatures.pl file. This must be created per the quick start guide.
signatures.pl syntax OK
| For any questions/comments, contact the devialog author: Jeff Yestrumskas (OSCP, CISM, CISSP) - jeff@yestrumskas.com |