new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

logging/system_events

5 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

sys_shutdown event logging

Log system shutdown events with event name 'sys_shutdown' followed by userid (if available). Level is WARN. Valuable for serverless and container systems.

sys_crash event logging

Log system crashes with event name 'sys_crash' followed by reason. Level is WARN. Example: event='sys_crash:outofmemory'. Especially important if crash is triggered by an attack.

sys_monitor_disabled event logging

Log when monitoring agents are halted with event name 'sys_monitor_disabled' followed by userid and monitor name. Level is WARN. Monitors may include file integrity, resource monitors, logging agents, virus scanners, etc. Example: event='sys_monitor_disabled:joebob1,crowdstrike'.

sys_monitor_enabled event logging

Log when monitoring agents are restarted with event name 'sys_monitor_enabled' followed by userid and monitor name. Level is WARN. Example: event='sys_monitor_enabled:joebob1,crowdstrike'.

System lifecycle event logging (startup and restart)

Log system lifecycle events with WARN level, valuable for serverless and container systems. - sys_startup: Log when the system starts up, followed by userid (if available) - sys_restart: Log when the system restarts, followed by userid (if available)

Give your agent this brain