Re: [cobalt-users] http://www.psionic.com - down?

["cobalt raq4" <cobalt_list@xxxxxxxxxxx>]

Cheer Jeff

Have tried the google search, was and always is first avenue of attack, 
nothing of any real use to be found above the absolute basics.

I have found a better version of logcheck with the inclusion of a 
'logcheck.hacking.ignore' file which allows you to ignore regular expression 
strings from the 'Active System Attack' header of logcheck.
Its worth a look if you are getting tons of mail for words in the hacking 
that cant be ignored but can be egrep'ed out somehow for the given instance.
http://web.meepzor.com/packages/logcheck/

After the headaches I have been through over the last few days with 
logcheck, portsentry etc I am going to compile everything I did and put it 
up on the net somewhere. I think I am going to get a site together and all 
guides I compile for myself and my colleagues can be posted up on there. 
Watch this space!

Anyways, thanks again for your reply.
Marcus

> cobalt raq4 wrote:
>
> > Anyone else noticed that the psionic site has been down for a couple of
> > days? Anyone know why?
>
> This press release (http://newsroom.cisco.com/dlls/corp_122302.html)
> says Cisco completed the buyout of Psionic Systems on December 23rd.  Of
> course they'd be dumb to close down the website immediately, but you
> never know how dumb some people may be ...
>
> This rather long url:
>
> "http://www.cisco.com/pcgi-bin/search/search.pl?searchPhrase=psionic&nv=Search+All+Cisco.com%23%23cisco.com&nv=Business+Strategies+%26+Solutions%23%23cisco.com%23Business+Strategies+and+Solutions&nv=Networking+Solutions+%26+Provisioned+Services%23%23cisco.com%23Networking+Solutions&nv=Products+%26+Services%23%23cisco.com%23Products&nv=Technologies%23%23cisco.com%23Technologies&nv=Ordering%23%23cisco.com%23Ordering&nv=Technical+Support%23%23cisco.com%23Technical+Support&nv=Learning+%26+Events%23%23cisco.com%23Learning+and+Events&nv=Partners+%26+Resellers%23%23cisco.com%23Partners+and+Resellers&nv=About+Cisco%23%23cisco.com%23About+Cisco&language=en&country=US&accessLevel=Guest&siteToSearch=cisco.com";
>
> will give you a list of all the occurrences of "Psionic" on cisco.com,
> or if you don't want to cut and past such a long url, you can go to the
> Cisco home page "http://www.cisco.com/"; and search for "psionic"
> (without the quotes) on "Search All Cisco.com".
>
> > Can anyone point me in the direction of a good guide for 
> LogCheck/LogSentry,
>
> A search for logcheck at cisco.com returns nothing <frown>.
>
> A look through the "Real World Linux Security" book (Bob Toxen, Prentice
> Hall, 2001) says very little other then point to now possibly defunct
> pages at Psionic <frown>.
>
> Try googling "logcheck".


_________________________________________________________________
MSN 8: advanced junk mail protection and 2 months FREE*. 
http://join.msn.com/?page=features/junkmail