Never lose a Syslog Message - Alexander Bluhm
Channel: EuroBSDcon
Date: 2019-10-16

Description:

On security systems logging is crucial. You have to know what an
attacker was doing. Also the attacker could provoke that important
information is lost. To provide a reliable view of the system, I
have implemented a bunch of mechanisms in the OpenBSD kernel and
syslogd(8).
Unfortunately traditional BSD syslog protocol is based on datagram
sockets and UDP messages. Both may fail unnoticed. The new system
call sendmessage(2) makes local logging work in harsh conditions
and also provides a single point from where errors can be reported.
Overflow of dmesg(8) buffer is detected and reported. For remote
logging TCP and TLS transport have been implemented together with
counters of lost messages due to buffer exhaustion.

The talk will explain these mechanisms together with more new
features in OpenBSD syslogd(8).

Speaker biography:

 - developer bluhm@openbsd.org since 2007
 - working for genua GmbH, a company which builds OpenBSD based firewalls