Here is a new recipe. We are working into a new hybrid cloud with Microsoft Azure and our offices. One of the requirements was the limitation of the bandwidth, between on premise servers and services in Azure servers, because we only have a link of 20Mbps and this link has to provide access to clients and to our infrastructures in Azure. So we decided to limit the bandwidth to 8Mbps, between both sites. Here is the configuration example.
Showing posts with label security. Show all posts
Showing posts with label security. Show all posts
Wednesday, July 16, 2014
Tuesday, March 11, 2014
SCOM 2012 check root login into CentOS system
Continuing the previous post, here is a recipe to rise an alert when root or privileged account has login into CentOS box via SSHD.
Obviously, for this recipe you need the Unix/Linux Management Packs applied and properly configured, here is an old post concerning this topic.
There are at least two ways, via ACS or via Unix/Linux Log file monitoring to rise this type of alerts.
The quickest and easiest way is with Log file monitoring, but it is less accurate than ACS, for example ACS has a set of reports to get detailed login statistics, but in some scenarios, it could be noisy and complex to manage.
Sunday, March 9, 2014
SCOM 2012 - Create alert / monitor based on Windows event ( Administrator login alert )
Today, our customer asks us how we can know when the Administrator has logon via terminal server on Windows Server on their Domain.
The answer is with SCOM, using the event alert feature.
When you do a login in Windows 2008 or higher and the audit is running an event with id 4624 is created in the security log of the machine.
So first step to create the alert / monitor is to enable the audit.
You have to add new group policy with the audit enabled in the OU of the computers that you want to monitor, in this image you can see highlighted what you need.
The answer is with SCOM, using the event alert feature.
When you do a login in Windows 2008 or higher and the audit is running an event with id 4624 is created in the security log of the machine.
So first step to create the alert / monitor is to enable the audit.
You have to add new group policy with the audit enabled in the OU of the computers that you want to monitor, in this image you can see highlighted what you need.
Subscribe to:
Posts (Atom)