In the end of the last section we talked about event monitoring with operating system logs.
In this section we are going to look at different types of data that can be collected from a network
for security investigations and troubleshooting.
In addition to operating system logging there is network logging network logs are generated on devices
like routers switches and firewalls.
These logs provide information on network events such as firewall rule blocks resource issues in device
configuration changes.
So if I want to find out why the network is slow or if there was a security event then I could use these
logs to possibly find out what happened.
Network logs are classified based on severe cities.
For example if a firewall reboot.
It may be classified as an emergency but if a VPN user logged in that would be considered to be an informational
log.
For logging to be a reliable monitoring resource you must have accurate time if an event occurs at 1
am on my system but my log shows that it happened at 3 am because the device this time was inaccurate
then it would be impossible to investigate an incident accurate time can be achieved by having network
devices synchronize their time by using the A.P. protocol with a.p client devices receive accurate time
updates from anti-peace servers.
So you can see a.p in action.
I log into the core switch in the lab so you can see its current time compared to my computer time as
well as its a.p status and settings.
So here is my core switch in the lab.
If I run the command show clock I can see that the time matches my accurate computer time.
I could mentally set my time on my network devices but of course if they were to reboot or were down
for a certain period of time they would slowly drift away from having accurate time.
Especially with spring forward and fall back changes.
So in my router configuration I have added anti-peace server destination so I have the switch requesting
time updates from these four a.p servers out on the Internet.
So if I don't show anti-B status I can see that my clock is synchronized and then TB server it's currently
seeking to is that this IP address so I don't have to worry about anything.
I know that when I look at my log on my course which is always going to match when the event occurred.
So you can see I have some local logs on this course which now with local logging you're always going
to have a limitation on how much logging information you can store locally on the device.
So best practice with logging not only for network troubleshooting but even more so for security is
to say when you're logging information to an external logging server I actually have a logging application
running on my computer here.
So what I'll do.
Assign logging information from this course switch to my local computer which in the real world you
would normally have a dedicated logging server.
I would recommend using a computer like I am I just want to show you what it looks like to see a logging
application on an external logging server.
So here is my sis log server application.
I'm going to generate some logging information on my switch or go to configuration mode and I will shut
down the interface on my lap switch.
So I'll shut down port 14 since it's not being used but still we get analog so as you can see on my
X10 turn logging server it showed that my user account logged in and ran the shut down command line
interface 114.
So as you can see having an external database of auditing information can be very useful so if somebody
logged in to my switch that wasn't me I could look at my log server and see what time they logged in
and what user account they used depending on how the logging server is configured you could see logs
from over a year's time depending on how far you had to go back in time for a security investigation.