Subject: Q: An API to report network abuse locally

From: Alessandro Vesely <[email-masked]>
Date: Sat, 01 Aug 2009 17:39:36 +0200

Hi all,
I'm wondering whether there is anything better than parsing log 
files to get specific types of abuse.

Dictionary attacks, netbot spam, and similar bad behavior can be 
diagnosed by the relevant application. It responds a suitable error 
code, and usually writes a log line. It is CPU intensive to parse 
the log files in order to extract the relevant IP address and take 
appropriate action. (The specific action, e.g. block port 25 using 
iptables for the next 10 minutes, is obviously part of local 
system/network policies.)

Isn't it possible to configure what agent should get what notices 
without parsing log files? Would that be part of SNMP, GSS, STREAMS 
or what? Any idea?

TIA