If such a law exists its rather pointless unless for defending false claims. If you were to get hacked/unauthorised access and need to provide evidence surely the offender would have removed that from the logs, or the logs alltogether. Therefor puting you in a position of breaking the law? Or have I missed the point on keeping logs entirely. Cheers Rob On Tue, 2004-03-23 at 20:40, Rodger Donaldson wrote:

On Tue, Mar 23, 2004 at 05:18:19PM +1200, Cameron Kerr wrote:

...

Hello all, I know that in some countries there are legal requirements for how long logs are meant to be held for. Are their such laws like that in NZ, and can anyone point me to any references?

It will depend on what you're doing. I know one of my clients retains logs for everything from their web servers on back for 7 years to comply with various acts around banking.

-- Rodger Donaldson rodgerd(a)diaspora.gen.nz "We have cornered the market on senselessness and profited." _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

On Wed, Mar 24, 2004, James Riden thus spake:

else. The truly paranoid will use a listen-only ethernet cable.

Indeed. The Honeynet folks, besides having a hardened syslog server, also sniff syslog traffic off the wire as part of the Snort setup, so there's simply no point of entry to the syslog data from the compromised network. Other equally paranoid types have proposed various solutions of dumping to write-only media, such as cdr or a plain ol' paper printer. Anyway, if you're sufficiently motivated there are plenty of failsafe methods to ensure the logs aren't compromised (though internal compromise is still theoretically possible). Regards, Ed Hintz ed(a)hintz.org

On 23 Mar 2004, at 15:59, James Riden wrote:

There's a good paper by Schneier about how to make tamper-proof logs so you can detect unauthorised modifications, but it's easier to remote syslog to another server, one which doesn't do anything else. The truly paranoid will use a listen-only ethernet cable.

The truly paranoid also won't use syslog :-) Has anybody seen an implementation of RFC3195 in the wild, by the way? Joe