Access to the syslogd process should be prohibited to protect against messages created by external network users. There is no need to accept any syslog message from outside the internal network. Filtering should apply to any internal destination address. There is no protection against this threat when using syslog. Identify new syslog messages.
Every application produces different messages in varying formats when using syslog.
We recommend initially storing every log message produced by a given application and reviewing the results to become familiar with the output. If you develop new application programs, you need to include the format and meaning of each log message in the design documentation. Known expected messages can be stored in a database for comparison purposes. Unknown messages can be written to a separate file for later review. Copyright 2000 Carnegie Mellon University CERT is registered in the U.S. Patent and Trademark Office.