Eyeing Jim, huh? I won't worry until you start playing Gordon Lightfoot
songs for him ;)
Though the db route seems like a "last resort" to you, there is some cool
stuff you can do if you decide to go there... If you log to SQL, not only
do you get rich data gathering and analysis capabilities for reporting, you
can also take advantage of somewhat real-time procedure execution in a more
robust environment... For instance, a "run while idle" job can easily
aggregate log data in pseudo-real-time to launch email/pager/etc alerts, or
execute "rule injection" scripts back to the ISA server that are suited to
your needs. (Note that "run while idle" requires the MSSQL service to be
running as a local admin, so secure that box well if you use RWI as opposed
to something that runs every few minutes or so...)
I've been planning to implement something like this for 2k4 as I used to do
with 2k when I get some free (HA!) time... But let me know if you'd like
some help with the SQL end of things. I've messed with SQL once or twice ;)
t
http://www.ISAserver.org
Im looking for something that allows me to be alerted when I get a scan or connection fail/attempt from a particular ip (one I would like to specify).
I would like to be able to do it through the alerts stuff but it doesn't allow it. I have thought of logging to a database and writing a query that pulls that info and mails me when it happens, but that is somewhere I will only go if I really need to..
I'm eyeing Jim here with the possibility that a script can do it, but im not sure..
Any suggestions..
G
