Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I had a colleague suggest setting up a server on a separate network that doesn't have an IP address to act as a log server. The idea being that you could broadcast log information and the log server could pick it up and store it, but there wouldn't be any way to actually connect to the box.

Is this something that people do? Has it been done before? Is it practical? Is it a good idea? How would it be implemented in Linux?

Thanks

share|improve this question
2  
Doesn't sound practical at all if you have more than one Layer 3 network...unless you are enabling broadcast forwarding which is pretty dumb –  TheCleaner Sep 23 '09 at 16:20

2 Answers 2

up vote 10 down vote accepted

Do you have some mayor paranoia?

Lots of things can be done, but you have to ask yourself, is this useful? Think about the amount of time you would need for such a solution to be implemented.

I guess you could do some kind of broadcast being sniffed by that logger box, but, to be honest, this sounds very impractical to me. Imagine someone sniffing your network and he gets all those interesting infos being written to your log host..

I think the better way is to use someting like syslog-ng with TLS secured communication channels between the sending and receiving servers..

regards, Comradin

share|improve this answer
1  
+1 Great observation, broadcasting log data in the name of security. –  kmarsh Sep 23 '09 at 16:11
    
Well the idea was that it's a private network in the server room only... so if someone had access to that then sure, they could sniff it... but anyways, I just didn't know if there was stuff out there for doing this already and it was widely supported, or if it was just an idea this guy thought up one day... now I know –  Max Schmeling Sep 23 '09 at 17:24

not to say it's entirely a looney idea, although it is a bit on the fringe of it =)

We did something similar in my environment to track the logs of our custom VMS sockets, however instead of broadcast, we used multicast so that the various developers could fire up a client, set up a couple of filters, and have access to real-time data from said socket code.

For plain logging porpoises, I'd suggest a hardened box, with no services available except syslog, and very limited physical/console access.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.