There are plenty of documented network security breaches that took place over an extended period of time. In these slow breaches, often times evidence indicates that there were signs and traces in both the server and network logs that indicates suspicious activities. The undetected activities were not detected not because there was a lack of information, but rather there are too much information. The critical information that we were looking for are usually buried deep in a mountain of information that are hard to sort out.
Note
Besides syslog, Uncomplicated Firewall (UFW) is another great source of log information for servers. It is a frontend to iptable, which is a server firewall. UFW makes managing firewall rules very simple and logs good amount of information. See Other tools section for more information on UFW.
In this section, we will try to use Python to search through the syslog text in order to detect the activities that we were looking for. Of course, the exact...