-: Network logging. 2 2
In this lesson, we're going to discuss how we conduct 3 3
network logging inside of our networks. 4 4
Now all of our network devices are going to generate logs 5 5
based on the information, events, warnings, alerts, 6 6
and other critical data that they generate. 7 7
If you have a very small network, 8 8
it's pretty easy for you to log into a network device 9 9
and review the logs individually or manually. 10 10
But, if you're like me and you start working on large 11 11
enterprise networks, this is impossible. 12 12
For example, 13 13
one of the networks I previously worked on 14 14
had thousands of network switches and hundreds of routers. 15 15
There is no way I could possibly log into each and every one 16 16
of them and review those log files individually, 17 17
each and every day. 18 18
So instead we use something known as Syslog. 19 19
Syslog is a protocol that's used to send these logs 20 20
to a centralized server. 21 21
This becomes the easiest way for us to gather all the logs 22 22
across all our routers and switches 23 23
and bring them back to a central point 24 24
where we can analyze and review them. 25 25
All of our routers, our switches, our servers, 26 26
and all of our other devices can be configured 27 27
to send their own logs back to the centralized server, 28 28
to make our jobs easier and more efficient; 29 29
if we use syslog. 30 30
These centralized servers are known as syslog servers. 31 31
Or you can have a SIM, 32 32
which is a Security Information Management System. 33 33
Or a SEM, a Security Event Management System. 34 34
Or the new combination of the two known, as a SIEM, 35 35
a Security Information and Event Management System. 36 36
These days, most people have moved to a SIEM 37 37
because it combines the functionality 38 38
of all these other types of logging 39 39
and analysis systems into one device. 40 40
By sending all of your logs to the centralized server, 41 41
it allows you, as an administrator or analyst, 42 42
to normalize and correlate the events 43 43
in order to see trends over time. 44 44
For example, if I see someone's conducting 45 45
a ping sweep of my firewall, 46 46
that's really not that big of a deal. 47 47
But, if I see that as coming within a few minutes of that 48 48
sweep, and I see from the same IP address, 49 49
somebody trying to connect to my servers or my clients, 50 50
that may be a concern that can be flagged for investigation. 51 51
Because maybe, they were preparing the environment 52 52
by seeing what ports were open. 53 53
And now they're launching an attack. 54 54
When you configure your syslog server, 55 55
your SIM, your SEM, or your SIEM, 56 56
there are two primary components you have to have. 57 57
You have to have a client and you have to have a server. 58 58
Now, a client is just the device 59 59
that's going to send the log information 60 60
to the syslog server. 61 61
This can be a router, a switch, a firewall, 62 62
a web server, or any other type of device. 63 63
Then you have a server and this is going to receive 64 64
and store all those logs from all the different clients. 65 65
Each client can be configured to send logs to the server 66 66
based on different severity levels 67 67
of the information they contain. 68 68
Now, when it does this, it's going to send the data 69 69
over port 514, using UDP, 70 70
the User Datagram Protocol. 71 71
Now syslog has eight different severity levels. 72 72
The severity levels start at zero 73 73
and they count upward to seven. 74 74
So zero is going to be the most severe 75 75
and seven is going to be the least severe 76 76
or the most benign. 77 77
Now level zero is going to be used for emergencies, 78 78
and it's going to be considered the most severe condition 79 79
because the system has now become unstable. 80 80
With level one, we're going to have an alert condition. 81 81
And this means there's a condition 82 82
that should be corrected immediately. 83 83
Level two is used for a critical condition. 84 84
And it means there's a failure 85 85
in the system's primary application. 86 86
And it requires somebody immediate attention. 87 87
With level three, we have an error condition. 88 88
And it means that something is happening to the system 89 89
that's preventing it from functioning properly. 90 90
Now, for example, 91 91
your file system storage may have reached it's limits 92 92
and now the system can't write the data. 93 93
And so it's generating a write error 94 94
when it tries to save that log information. 95 95
And that could generate an error condition. 96 96
Now level four is going to be used for warning conditions, 97 97
and it can indicate that an error is going to occur 98 98
if action isn't taken soon. 99 99
For example, let's say your file system 100 100
only has two gigabytes of space remaining. 101 101
So you need to free up more space 102 102
before you start to get write errors. 103 103
This can send an alert. 104 104
This would be known as a warning condition 105 105
because you're running out of this space. 106 106
Now level five is used for notice conditions. 107 107
And that means these are events that are unusual, 108 108
but they're not exactly error conditions. 109 109
Level six is for information conditions. 110 110
And this is going to be a normal operational message 111 111
that requires no action. 112 112
For example, you might see in your logs 113 113
that an application has started or paused 114 114
or ended successfully. 115 115
These are all informational logs. 116 116
Level seven is going to be used for debugging conditions. 117 117
And it's just information that's useful to developers 118 118
as they're debugging their networks and their applications. 119 119
Now, as a network or system administrator, 120 120
it's your responsibility to determine 121 121
what levels should be logged 122 122
and how long do you want to keep those logs inside 123 123
your syslog server or your SIEM? 124 124
Now, while we would love to keep everything forever. 125 125
For most of us, that's just not practical 126 126
because we'll eventually run out of hard disk space. 127 127
So, some administrators will limit what they log. 128 128
And they decide to only log things 129 129
from level zero to level five. 130 130
And they'll ignore the informational or debugging logs. 131 131
This all depends on your organization and the policies 132 132
you're going to set forth inside your business. 133 133
All right, 134 134
we've talked a lot about logs so far in syslog. 135 135
But we haven't really looked at one yet. 136 136
So let's pull up a log and take a look inside. 137 137
Here's an example from a syslog server. 138 138
Here, we have the date, the time, the location, 139 139
and then we have the log level. 140 140
And you could see things like alerts, emergency, 141 141
error, warning, notice, informational, 142 142
and things like that. 143 143
Then, you have the machine or the host name 144 144
and the IP in the next column. 145 145
So, you know, what machine did the reporting 146 146
of this error or information or warning. 147 147
Then you have the actual text of the log message itself. 148 148
This will say things like, "this is a test message", 149 149
or "this is an error. And here's the error I had". 150 150
By having this information and understanding 151 151
what it is, as an analyst or administrator, 152 152
you can start going back and figuring out what caused 153 153
the incident and what really occurred. 154 154
Now for the exam, what do you need to know about syslog? 155 155
Well, you need to understand the eight different levels. 156 156
You may get a question that says, 157 157
"what is level number three in syslog?" 158 158
And you need to say, "that's an error message". 159 159
Alright, let's go ahead 160 160
and talk a little bit more about logs. 161 161
Remember, a syslog server is all just a big collection of 162 162
all the different logs from all the different servers 163 163
and clients and network devices we have. 164 164
Now, when it comes to network device logs, 165 165
we can review these inside the syslog server, 166 166
as well as by looking at our traffic logs 167 167
and our audit logs. 168 168
Now, when it comes to network traffic logs, 169 169
these are going to contain information about traffic flows 170 170
within your network. 171 171
For example, if you collect network traffic logs 172 172
from your router or your firewall, 173 173
you're going to see a list of every connection 174 174
that's been made to and from your network. 175 175
For example, 176 176
you could see the source IP, the source port, 177 177
the destination IP, the destination port, 178 178
as well as the Mac address of the client, 179 179
the time it took to occur, the length of the packet, 180 180
and even it's time to live. 181 181
Then you can analyze these traffic flows 182 182
to determine if this is normal traffic for you 183 183
and something you'd expect to see in your baseline. 184 184
Or, is this something that's abnormal 185 185
and needs to be investigated further? 186 186
For example, if you know that in a given day, 187 187
you're used to seeing about a gigabyte of data 188 188
leaving your network over port 443, 189 189
but today you saw 10 gigabytes of data 190 190
was leaving your network. 191 191
That is something you need to worry about. 192 192
So you might take a look at that and see, 193 193
have you been hacked? 194 194
Is somebody stealing all your data? 195 195
Now does it mean that's happening? 196 196
Well, not necessarily. 197 197
But we do know it's abnormal, because we expect to see 198 198
somewhere around one. And right now we're seeing around 10. 199 199
So we need an investigate that closer 200 200
and dive into those network traffic logs 201 201
to see what's happening. 202 202
Let's say for example, that happened in my company. 203 203
I would want to investigate that. 204 204
Now, most likely what I'll 205 205
find is that my video editor was uploading all of our videos 206 206
to cloud-based servers because 10 gigabytes of data 207 207
is only about an hour or two, a video for our courses. 208 208
Now she might edit all week and then on Friday, 209 209
upload all that data. 210 210
And that's why we're seeing that big spike on Friday. 211 211
Similarly, if you see traffic that you're not expecting, 212 212
like somebody saying data over some port that you're not 213 213
using, like port 21 for FTP, 214 214
but you don't have an FTP server. 215 215
This could be something that's abnormal 216 216
and suspicious as well. 217 217
The key to understanding your network traffic logs 218 218
is understanding what normal looks like. 219 219
And so you have to understand what normal is 220 220
in your baseline. 221 221
So you can then determine what is abnormal 222 222
and what needs to be looked at 223 223
much more closely as you do investigations. 224 224
Also, when you're looking at your traffic logs, 225 225
this can help you during your troubleshooting efforts. 226 226
For example, 227 227
you might see that you're trying to send data 228 228
to a particular IP address. 229 229
But it's stopping at a particular router or firewall 230 230
within your network. 231 231
By investigating this and the traffic logs, 232 232
you can determine why this blockage is occurring. 233 233
Now the second type of network device log 234 234
we need to talk about is an audit log. 235 235
Now, an audit log or audit trail is a record 236 236
of all the events and changes 237 237
that have happened on that device. 238 238
Every IT device keeps a log based on the events 239 239
and an audit log is typically going to contain 240 240
a sequence of events for a particular activity. 241 241
In a network device, this would be something 242 242
like a configuration change that you made to that system. 243 243
So let's say, for example, 244 244
you came into work and you found that somebody changed 245 245
the configuration on your border gateway router. 246 246
Now, you could log in and see who made that change 247 247
and exactly what changes were made 248 248
by reviewing that audit log for the device. 249 249
For your convenience, these audit logs 250 250
can be sent over syslog to that centralized server 251 251
for review and analysis as well. 252 252
Now, when it comes to servers and clients, 253 253
we're usually going to be using windows machines 254 254
in enterprise networks. 255 255
For windows, there are three main types of logs 256 256
you can also collect. 257 257
These are application logs, security logs, and system logs. 258 258
To view these logs, you can open your event viewer 259 259
on a windows system and access the different 260 260
types of logs. 261 261
The first one is an application log. 262 262
In windows this contains information 263 263
about the software running on your client or server. 264 264
Now, there are three severity levels 265 265
in a windows application log. 266 266
We have informational, warning, or error. 267 267
For example, if you have Microsoft word 268 268
and it crashes on you, you can go check 269 269
the application log and figure out why it keeps crashing. 270 270
Our second one we have is a security log. 271 271
The security log contains information about 272 272
the security of your client or server. 273 273
This is going to have things like successful 274 274
and failed login attempts, 275 275
and other pertinent security information. 276 276
This will also show you if an audit success or audit failure 277 277
occurred for those logs. 278 278
Now, the third one we have is a system log. 279 279
The system log contains all the information 280 280
about the operating system itself. 281 281
There are three severity codes here; 282 282
just like the application log. 283 283
We're still going to have informational, warning, and error. 284 284
In this example, there are four errors 285 285
and the rest were informational items. 286 286
The errors are notated by that red exclamation mark. 287 287
Whereas, if you see the warning, 288 288
it's going to be a yellow triangle. 289 289
And information is a white circle 290 290
with a blue I inside of it.