I had a similar problem and found when I checked the events details that
they had been cleared by the sensor. After raising it with ISS it might be
an issue with some signatures, if you switch the logwithraw off again your
signatures will come back. If you really need to see the packets I suggest
you turn on packetcapture mode and use a packet analyzer
Regards
Jeff
-----Original Message-----
From: issforum-bounces@iss.net [mailto:issforum-bounces@iss.net] On Behalf
Of Sergey V Soldatov
Sent: 24 March 2005 16:06
To: issforum@iss.net
Subject: [ISSForum] LOGDB:LogWithRaw
AFAIK, LogWithRaw is the only convenient way to see raw packet data of
event. In this case raw packet data will bw stored in DB and can be viewed
in event details. Please, if someone has something to add to my explanation
about LogWithRaw, inform me, because this parameter is very poor descrabed
in docs and student's guides.
I tried to use this for analysis of IM activities, LDAP sessions, etc,
where user credentials are transferred in clear text. But I'd found that
after changing LOGDB form LogWithoutRow to LogWithRaw these events had
stopped to be shown in SP Console. I could see events with LogWithRaw
switched on in Event Viewer, but not in Console. Can someone help me to
understand what's the problem?
Another question is for ISS or somebody who knows ISS's future plans.
Does ISS plan to realize storage of evidence in DB? Because in current
implementation LogEvidence feature almost useless, because it's completely
impossible to find needed evidence for desired event, especially in case
when number of events have Log Evidence switched on. I wrote about this on
enhancements@iss.net, but I don't knoe the fate of that letter.
Thanks.
---
Best regards, Sergey V. Soldatov.
Information security department.
tel/fax +7 095 745 89 50 (1613)
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security
Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
