Given all the effort a skilled intruder will use to cover their tracks, keeping the attacker from slipping away without warning them that they're being watched can be tricky. The safest approach is to collect as much information from as many sources as possible. While much of the data collected may prove to be redundant, a breakdown or compromise of any one part of the monitoring system should not disable the honeypot. In fact, data from one source that is not reflected in another can itself provide useful insight into an attacker's methods. The first point for data collection is the honeypot's own firewall.
Most firewalls are capable of logging all traffic they examine.
Under normal conditions, these logs are often packed with so much legitimate traffic that distinguishing an attack can prove extremely difficult. Since this firewall only connects to the honeypot, and the honeypot has no legitimate users, any traffic appearing in the firewall logs should be evidence of an attack. Many firewalls can also be configured to trigger an alert in response to a perceived attack. Given the honeypot's lack of legitimate traffic, the odds of receiving a false positive under these circumstances is very low. The second data collection tool is the honeypot's own system logs.