sql monitoring

PeopleSoft Performance Tuning

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEizNdXtk1-nbUY1ZAJEto51spwOy5fIS7kb_q7520apPdliXMqwYh1PPxww_ensi8vI2zxzAnusY5_k0FbKGxzAvX5FfxIyQ3uotyEGmgsSL5C9dlcnSy4vN5Si-jHelI_V2IgCvFDkvkY/s1600/PeopleSoft+Performance+Tuning.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEizNdXtk1-nbUY1ZAJEto51spwOy5fIS7kb_q7520apPdliXMqwYh1PPxww_ensi8vI2zxzAnusY5_k0FbKGxzAvX5FfxIyQ3uotyEGmgsSL5C9dlcnSy4vN5Si-jHelI_V2IgCvFDkvkY/s1600/PeopleSoft+Performance+Tuning.png" /></a></div>
<div style="-webkit-font-smoothing: subpixel-antialiased; -webkit-tap-highlight-color: transparent; background-color: white; box-sizing: border-box; color: #777777; font-family: Arial, Helvetica, sans-serif; font-size: 13px; line-height: 22.75px; margin-bottom: 15px;">
<br /></div>
<div style="-webkit-font-smoothing: subpixel-antialiased; -webkit-tap-highlight-color: transparent; background-color: white; box-sizing: border-box; color: #777777; font-family: Arial, Helvetica, sans-serif; font-size: 13px; line-height: 22.75px; margin-bottom: 15px;">
<br /></div>
<div style="-webkit-font-smoothing: subpixel-antialiased; -webkit-tap-highlight-color: transparent; background-color: white; box-sizing: border-box; font-family: Arial, Helvetica, sans-serif; font-size: 13px; line-height: 22.75px; margin-bottom: 15px;">
1. Introduction:<br />
It is a widely known fact that 80 % of performance problems are a direct result of the poor performance, such as server configuration, resource contention. Assuming you have tuned your servers and followed the guidelines for your database server, application server, and web server, most of your performance problems can be addressed by tuning the PeopleSoft Application.<br />
{This article presents methodologies and techniques for optimizing the performance of PeopleSoft applications. The methodologies that are discussed are intended to provide useful tips that will help to better tune your PeopleSoft applications. These tips focus on tuning several different aspects within a PeopleSoft environment ranging from servers to indexes. You will find some of these tips provide you with a significant improvement in performance while others may not apply to your environment.|The methodologies that are discussed are intended to provide useful tips that will help to better tune your PeopleSoft applications. These tips focus on tuning several different aspects within a PeopleSoft environment ranging from servers to indexes.}<br />
2. Server Performance:<br />
In general, the approach to application tuning starts by examining the consumption of resources. The entire system needs to be monitored to analyze resource consumption on an individual component basis and as a whole.<br />
<br />
The key to tuning servers in a PeopleSoft environment is to implement a methodology to accurately capture as much information as possible without utilizing critical resources needed to serve the end-users.<br />
Traditional tools used to measure utilizations impact the system being measured and ultimately the end-user experience. Commands like the following provide snapshot data but not without an associated cost. {These tools can consume a significant amount of resources so care should be taken when executing them.|When executing them, these tools can consume a significant amount of resources so care should be taken.}<br />
a) df size<br />
b) iostat swapinfo<br />
c) ipcs timex<br />
d) netstat top<br />
f) ps uptime<br />
g) sar vmstat<br />
h) swapinfo also glance & gpm<br />
{The goal of using these native commands is to identify, if and where, a bottleneck is in the server. Is the problem in the CPU, I/O or memory? These native tools provide indicators, but at the same time could skew the results because of the overhead associated with them. Typically, additional third party tools are needed to complete the analysis.|The goal of using these native commands is to identify, if and where, a bottleneck is in the server. These native tools provide indicators, but at the same time could skew the results because of the overhead associated with them.}<br />
{{The last hurdle being faced in tuning the server is making timing decisions on when to upgrade the hardware itself.|When to upgrade the hardware itself, the last hurdle being faced in tuning the server is making timing decisions on.} To do this, much more information needs to be collected and stored in order to understand if an historical spike in resource utilization was {a one-time aberration or a regular occurrence|a regular occurrence or a one-time aberration} building over time. The recommendation is to look at third party vendors for solutions that can collect key performance indicators while minimizing overhead on the system. The collected data can then be put in a repository for detailed historical analysis.|The last hurdle being faced in tuning the server is making timing decisions on when to upgrade the hardware itself. The recommendation is to look at third party vendors for solutions that can collect key performance indicators while minimizing overhead on the system.}<br />
3. Web Server Performance:<br />
{The release of PeopleSoft Pure Internet Architecture(TM) introduces new components to PeopleSoft architecture-- the web server and application server. The application server is where most shops struggle with appropriate sizing. Web servers are used for handling the end-user requests from a web browser to eliminate the administrative costs associated with loading software (fat clients) on individual desktops. The benefit is a significant savings on software deployment costs, maintenance, and upgrades. While the shift from fat clients to thin lessens the administrative burden, it increases the need to ensure the web servers are finely tuned since they will service a large number of clients. The requirement for these web servers to achieve optimal performance is vital due to the mission critical-nature PeopleSoft plays in today's enterprise.|The release of PeopleSoft Pure Internet Architecture(TM) introduces new components to PeopleSoft architecture-- the web server and application server. The application server is where most shops struggle with appropriate sizing. The requirement for these web servers to achieve optimal performance is vital due to the mission critical-nature PeopleSoft plays in today's enterprise.}<br />
Recommendations for ensuring good performance for web servers:<br />
o Ensure load balancing strategy is sound<br />
o Implement a solution to verify and highlight changes in traffic volumes<br />
o Closely monitor the response times to verify that the strategy is optimizing the web servers<br />
o Measure and review historical patterns on server resource utilization (see server section above).<br />
o Increase the HEAP size to 200, 250, 300, or 380 MB for the web logic startup script.<br />
4. Tuxedo Performance Management:<br />
Tuxedo is additional middleware PeopleSoft utilizes to manage the following Internet application server services:<br />
o Component Processor-- Responsible for executing PeopleSoft Components-- the core PeopleSoft application business logic<br />
o Business Interlink Processor-- Responsible for managing the interactions with third-party systems<br />
o Application Messaging Processor-- Manages messages in a PeopleSoft system<br />
o User Interface Generator-- Generates the user interface based on the Component or Query definition and generates the appropriate markup language (HTML, WML, or XML) and scripting language (JavaScript, WMLScript) based on the client accessing the application<br />
o Security Manager-- Authenticates end-users and manages their system access privileges<br />
o Query Processor-- Executes queries using the PeopleSoft Query tool<br />
o Application Engine-- Executes PeopleSoft Application Engine processes<br />
o Process Scheduler-- Executes reports and batch processes and registers the reports in the Portal's Content Registry<br />
o SQL Access Manager-- Manages all interaction with the relational DBMS via SQL<br />
<br />
This Tuxedo middle tier is another {critical and influential|influential and critical} component of performance. Similar to the web server, what is needed is a way to see into the "black box" to further understand some of the key performance metrics.<br />
Some of the performance metrics to capture when analyzing tuxedo are:<br />
o Transaction volumes by {domain, server, and application|domain, application, and server|server, domain, and application|server, application, and domain|application, domain, and server|application, server, and domain}<br />
o Response time for each end-user request<br />
o Tuxedo service generating a poor performing SQL statement<br />
<br />
o Break down of Tuxedo time by Service time and Queue time<br />
o Identify problem origin-- is it in tuxedo or the database?<br />
o Response time comparisons for multiple Tuxedo Server<br />
Reports has shown that too often companies throw hardware at a Tuxedo performance problem when a more effective solution can be as simple as adding another domain to the existing server(s). This is due to the fact that PeopleSoft and Tuxedo lack management solutions that provide historical views of performance.<br />
5. Application Performance:<br />
It is an accepted fact that 80 % of application and database problems reside in the application code. {But, there are other technical items to consider which could influence the applications performance.|There are other technical items to consider which could influence the applications performance.} Here are some specific items to focus on when evaluating database environment:<br />
o Make sure the database is sized and configured correctly<br />
o Make sure that the hardware and O/S environments are set up correctly<br />
o Verify that patch levels are current<br />
o Fix common SQL errors<br />
o Review documentation of known problems with PeopleSoft supplied code<br />
o Be sure to check available patches from PeopleSoft that might address the problem<br />
o Review PeopleSoft suggested kernel parameters<br />
o Set up the right number of processes<br />
o Review the application server blocking for Long Running Queries<br />
o Make sure not to undersize version 8 application server<br />
It is also recommended to continue to review these items on a periodic basis.<br />
6. Database Performance:<br />
The performance of an application depends on many factors. We will start with the overall general approach to tuning SQL statements. We will then move to such areas as indexes, performance monitoring, queries, the Tempdb (Tempdb is often referred to as plain "TEMP"), and, finally, servers and memory allocation.<br />
{To understand the effect of tuning, we must compare 'time in Oracle' with 'request wait time'. Request wait time is the time that a session is connected to Oracle, but not issuing SQL statements. {In Oracle time shows the amount of time resolving a SQL statement once it has been submitted to Oracle for execution.|Once it has been submitted to Oracle for execution, in Oracle time shows the amount of time resolving a SQL statement.} {If time in Oracle is not significantly smaller than the request wait time, then application tuning should be examined.|Application tuning should be examined if time in Oracle is not significantly smaller than the request wait time.} Request wait time is almost always much greater than in Oracle time, especially for on line users, because of think time.|If time in Oracle is not significantly smaller than the request wait time, then application tuning should be examined. Request wait time is almost always much greater than in Oracle time, especially for on line users, because of think time.}<br />
One exception to this is for a batch job that connects to Oracle and submits SQL statements, then processes the returned data. A greater ratio of request wait to Oracle could indicate a loop in the application outside of Oracle.<br />
This should be identified and eliminated before continuing the performance analysis.<br />
<br />
{The next step focuses on tuning the SQL statements that use the most resources. To find the most resource consuming SQL statements, the scheduled collection approach can be used. The duration time is a commonly used criteria to locate the offensive SQL statements. Other useful criteria include the following wait states: I/O, row lock, table lock, shared pool, buffer, rollback segment, redo log buffer, internal lock, log switch and clear, background process, CPU, memory and I/O. For each offensive SQL statement, the execution plan and database statistics are analyzed. The following statistics are important: table and column selectivity, index clustering factor, and storage parameters. {First, all the joins of the SQL are considered.|All the joins of the SQL are considered.} For each join, the ordering of the tables is analyzed. It is of major importance to have the most selective filter condition for the driving table. {Then, the type of the join is considered.|The type of the join is considered.} {If the join |, if the join}|The next step focuses on tuning the SQL statements that use the most resources. The duration time is a commonly used criteria to locate the offensive SQL statements. The following statistics are important: table and column selectivity, index clustering factor, and storage parameters.}<br />
<br />
Represents a Nested Loop, forcing it into a hash join can be advantageous under some conditions.<br />
The analysis stage usually results in several modification proposals, which are applied and tested in sequence. Corrective actions include database object changes and SQL changes. The typical database object changes are: index change, index rebuild and table reorganization.<br />
The typical SQL changes are: replacing subquery with a join, splitting a SQL into multiple SQLs, and inserting Oracle hints to direct the Optimizer to the right execution plan.<br />
7. Indexes:<br />
{Tuning indexes is another important factor in improving performance in a PeopleSoft environment. Index maintenance is crucial to maintaining good database performance. Statistics about data distribution are maintained in each index. These statistics are used by the optimizer to decide which, if any, indexes to use. The statistics must also be maintained so that the optimizer can continue to make good decisions. Thus, procedures should be setup to update the statistics as often as is practical.|Tuning indexes is another important factor in improving performance in a PeopleSoft environment. Index maintenance is crucial to maintaining good database performance. These statistics are used by the optimizer to decide which, if any, indexes to use.}<br />
{Keep in mind that objects that do not change, do not need to have their statistics created again.|Objects that do not change, do not need to have their statistics created again.} {If the object has not changed, the stats will be the same.|The stats will be the same if the object has not changed.} In this case, recreating the same statistics over again will waste resources.<br />
Since PeopleSoft uses a lot of temp tables that are loaded and then deleted, but not dropped, it is helpful to create the statistics when those tables are full of data. {If the statistics are created when the table is empty, the stats will reflect that fact.|The stats will reflect that fact if the statistics are created when the table is empty.} {The Optimizer will not have correct information when it chooses an access path.|When it chooses an access path, the Optimizer will not have correct information.}<br />
{Periodically, indexes should be rebuilt to counter index fragmentation. An index creation script can be created via PeopleTools to drop and rebuild indexes. This procedure will eliminate index -wasted space on blocks that are created as a result of Oracle logical deletes. This is only necessary on tables that are changed often ({inserts, updates or deletions|inserts, deletions or updates|updates, inserts or deletions|updates, deletions or inserts|deletions, inserts or updates|deletions, updates or inserts}).|Periodically, indexes should be rebuilt to counter index fragmentation. An index creation script can be created via PeopleTools to drop and rebuild indexes.}<br />
{Index scheme is also important to look at. The indexes in a standard PeopleSoft installation may not be the most efficient ones for all installations. Closely examine data's pattern, distribution, and modify the indexes accordingly. {For example, the index on PS_VOUCHER (BUSINESS_UNIT, VOUCHER_ID) could be changed to (VOUCHER_ID, BUSINESS_UNIT) for an implementation with only a few business units.|The index on PS_VOUCHER (BUSINESS_UNIT, VOUCHER_ID) could be changed to (VOUCHER_ID, BUSINESS_UNIT) for an implementation with only a few business units.} Use ISQLW Query Options (Show Query Plan and Show Stats I/O) to determine the effectiveness of new indexes. {However, be careful to thoroughly test the new index scheme to find all of its ramifications.|Be careful to thoroughly test the new index scheme to find all of its ramifications.}|The indexes in a standard PeopleSoft installation may not be the most efficient ones for all installations. The index on PS_VOUCHER (BUSINESS_UNIT, VOUCHER_ID) could be changed to (VOUCHER_ID, BUSINESS_UNIT) for an implementation with only a few business units. Use ISQLW Query Options (Show Query Plan and Show Stats I/O) to determine the effectiveness of new indexes.}<br />
8. Queries:<br />
{It is a good idea to examine queries to try and fix a problem that is affecting the application. Query analyzer can be used to see optimizer plans of slow SQL statements. Choose "Query/Display Plan" to see a graphical representation of a query plan. {Alternatively, by issuing a "set showplan_text on" and running the statement will get a textual representation of the plan, showing indexes used, the order in which the tables were used, etc<br />
.|By issuing a "set showplan_text on" and running the statement will get a textual representation of the plan, showing indexes used, the order in which the tables were used, etc<br />
.} When investigating queries, worktables created per second should also be addressed. {If a large number of work tables being are created per second (i.e. hundreds per second), this means that a large amount of sorting is occurring.|This means that a large amount of sorting is occurring if a large number of work tables being are created per second (i.e. hundreds per second).} This may not be a serious a problem, especially if it does not correspond with a large amount of I/O.|It is a good idea to examine queries to try and fix a problem that is affecting the application. Query analyzer can be used to see optimizer plans of slow SQL statements. By issuing a "set showplan_text on" and running the statement will get a textual representation of the plan, showing indexes used, the order in which the tables were used, etc<br />
.}<br />
<br />
{However, performance could be improved by tuning the {queries and indexes|indexes and queries} involved in the sorts and, ideally, this will eliminate some sorting.|Performance could be improved by tuning the {queries and indexes|indexes and queries} involved in the sorts and, ideally, this will eliminate some sorting.}<br />
<br />
<br />
These tips focus on tuning several different aspects within a PeopleSoft environment ranging from servers to indexes. The release of PeopleSoft Pure Internet Architecture(TM) introduces new components to PeopleSoft architecture-- the web server and application server. The application server is where most shops struggle with appropriate sizing. The requirement for these web servers to achieve optimal performance is vital due to the mission critical-nature PeopleSoft plays in today's enterprise.<br />
We will then move to such areas as indexes, performance monitoring, queries, the Tempdb (Tempdb is often referred to as plain "TEMP"), and, finally, servers and memory allocation.</div>

PeopleSoft Performance Tuning

1. Introduction: It is a widely known fact that 80 % of performance problems are a direct result of the poor performance, such as se...

Event Log Monitoring for the PCI DSS

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgAXf_82k-j37OlW18eZuEI8GLUF10cI98gB-z-O1RRTTwnFUTBNlJBgMij-yx6MSCZfYSDivWH0gr_TMZooChjq_d1MGzkB2VGC8vV4NZrzMk25c4s87wi2aJRsWnyQsKaqIHfTs9xznk/s1600/Event+Log+Monitoring+for+the+PCI+DSS.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgAXf_82k-j37OlW18eZuEI8GLUF10cI98gB-z-O1RRTTwnFUTBNlJBgMij-yx6MSCZfYSDivWH0gr_TMZooChjq_d1MGzkB2VGC8vV4NZrzMk25c4s87wi2aJRsWnyQsKaqIHfTs9xznk/s1600/Event+Log+Monitoring+for+the+PCI+DSS.png" /></a></div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
<br /></div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
<br /></div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
This article has been produced to assist anyone concerned with ensuring their organization can meet PCI DSS obligations for event log management - "PCI DSS Section 10.2 Implement automated audit trails for all system components..."</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
There are typically two concerns that need to be addressed - first, "what is the best way to gather and centralize event logs?" And second, "what do we need to do with the event logs once we have them stored centrally? (And how will we cope with the volume?)"</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
To the letter of the PCI DSS, you are obliged to make use of event and audit logs in order to track user activity for any device within scope i.e. all devices which either 'touch' cardholder data or have access to cardholder data processing systems. The full heading of the Log Tracking section of the PCI DSS is as follows -</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
"PCI DSS Requirement 10: Track and monitor all access to network resources and cardholder data"</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
Logging mechanisms and the ability to track user activities are critical in preventing, detecting, or minimizing the impact of a data compromise. The presence of logs in all environments allows thorough tracking, alerting, and analysis when something does go wrong. Determining the cause of a compromise is very difficult without system activity logs.</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
Given that many PCI DSS estates will be geographically widespread it is always a good idea to use some means of centralizing log messages, however, you are obliged to take this route anyway if you read section 10.5.3 of the PCI DSS -</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
"Promptly back up audit trail files to a centralized log server or media that is difficult to alter"</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
The first obstacle to overcome is the gathering of event logs. Unix and Linux hosts can utilize their native syslogd capability, but Windows servers will need to use a third party Windows Sylog agent to transfer Windows Event Logs via syslog. This will ensure all event log messages form Windows servers are backed up centrally in accordance with the PCI DSS standard. Similarly, Oracle and SQL Server based applications will also require a Syslog Agent to extract log entries for forwarding to the central syslog server. Similarly, IBM z/OS mainframe or AS/400 systems will also need platform-specific agent technology to ensure event logs are backed up.</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
Of course, Firewalls and Intrusion Protection/Detection System (IPS/IDS), as well as the majority of switches and routers all natively generate syslog messages.</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
File-Integrity Monitoring and Vulnerability Scanning</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
While we are on the subject of deployment of agents to platforms for event log monitoring, it is worth considering the other dimensions of the PCI DSS, namely file-integrity monitoring and vulnerability scanning/assessment.</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
Both of these functions can be addressed using an agent on board your servers and workstations. File-Integrity monitoring (see section 11.5 of the PCI DSS) is necessary to ensure key program and operating system files are not infiltrated by Trojans or other malware, and that 'backdoor' code is not inserted within applications. File-Integrity Monitoring should be deployed to all PCs and Epos systems, Windows Servers, Unix and Linux hosts.</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
Vulnerability Scanning is a further element of the PCI DSS and requires all devices to be scanned regularly for the presence of security vulnerabilities. The key benefit of an agent based approach is that vulnerability scans can be performed continuously and any configuration changes rendering your PCs/Epos/Servers less secure or less 'hardened' will be identified and alerted to you. The agent will need valid PCI Security Settings/Vulnerability Assessment/PCI Hardening Checklists to be applied.</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
Event Log Backup to a Centralized Server</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
Once assembled, the Audit trail history must be backed up in a way that is "difficult to alter". Traditionally, write-once media has been used to ensure event histories cannot be altered but most centralized log server solutions now employ file-integrity monitoring as a means of detecting any attempt to change or edit the event log backup.</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
So in terms of our two initial questions, we have fully covered the first, but what about the next logical question of 'What do we do with - and how do we cope with - the event logs gathered?'</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
"PCI DSS Section 10.6 Review logs for all system components at least daily"</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
This is the part of the standard that causes most concern. If you consider the volume of event logs that may be generated by a typical firewall this can be significant, but if you are managing a retail estate of 800 stores with 7,500 devices within scope of the PCI DSS, the task of reviewing logs from devices is going to be impossible to achieve. This may be a good time to consider some automation of the process...?</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
The Security Information and Event Management or SIEM market as defined by Gartner covers the advanced generation of solutions that harvest audit and event logs, and then parse or interpret the events e.g. store events by device, event type and severity, and analyze the details within event logs as they are stored. In fact, the PCI DSS recognizes the potential value of this kind of technology</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
"Log harvesting, parsing, and alerting tools may be used to meet compliance with Requirement 10.6 of the PCI DSS"</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
SIEM technology allows event logs to be automatically and intelligently managed such that only genuinely serious security events are alerted. The best SIEM technology can distinguish between true hacker activity running a 'brute force' attack and a user who has simply forgotten their password and is repeatedly trying to access their account. Naturally there is an amount of customization required for each environment as every organization's network, systems, applications and usage patterns are unique as are the corresponding event log volumes and types.</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
The PCI Event log management process can be approached in three stages, ensuring that there is a straightforward progression through becoming compliant with the PCI DSS standard and becoming fully in control of your PCI Estate. The tree phases will assist you in understanding how your PCI Estate functions normally and, as a result, placing all genuine security threats into the spotlight.</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
1. GATHER - Implement the SIEM system and gather all event logs centrally - the SIEM technology will provide a keyword index of all events, reported by device type, event severity and even with just the basic, pre-defined rules applied, the volumes of logs by type can be established. You need to get familiar with the types of event log messages being collected and what 'good' looks like for your estate.</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
2. PROFILE - Refinement of event type identification and thresholds - once an initial baselining period has been completed we can then customize rules and thresholds to meet the profile of your estate, with the aim of establishing a profiled, 'steady-state' view of event types and volumes. Even though all logs must be gathered and retained for the PCI DSS, there is a large proportion of events which aren't significant on a day-to-day basis and the aim is to de-emphasize these in order to promote focus on those events which are significant.</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
3. FOCUS - simple thresholding for event types is adequate for some significant security events, such as anti-virus alerts or IPS signature detections, but for other security events it is necessary to correlate and pattern-match combinations and sequences of event. SIEM only becomes valuable when it is notifying you of a manageable number of significant security events.</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
It is important to note that even when certain events are being de-emphasized, these are still being retained in line with the PCI DSS guidelines which are to retain logs for 12 months. At least 3 months of event logs must be in an on-line, searchable format for at least 3 months, and archived for 12 months.<br /><br />Again, the archived and on-line log repositories must be protected from any editing or tampering so write-once media and file integrity monitoring must be used to preserve log file integrity.</div>

Event Log Monitoring for the PCI DSS

This article has been produced to assist anyone concerned with ensuring their organization can meet PCI DSS obligations for event log...

How To Speed Up a Slow Microsoft Access Database Running Over a Network

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjTybnkhoprdCeLxTKB0dxeBtGuUeyugsZh0voqOgMTwIj1U_BLXQfZL9ZyURG8_BKotjbzJJLFPvLPtUY2NXeRScBLO6f4wUhOcje1_ZVMbCplUXa3-WDMzsmNbpA6EfJHTvY9P8TUvDg/s1600/Database+Running+Over+a+Network.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjTybnkhoprdCeLxTKB0dxeBtGuUeyugsZh0voqOgMTwIj1U_BLXQfZL9ZyURG8_BKotjbzJJLFPvLPtUY2NXeRScBLO6f4wUhOcje1_ZVMbCplUXa3-WDMzsmNbpA6EfJHTvY9P8TUvDg/s1600/Database+Running+Over+a+Network.jpg" /></a></div>
<br />
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
Event Log, Audit Log and Syslog messages have always been a good source of troubleshooting and diagnostic information, but the need to back up audit trail files to a centralized log server is now a mandatory component of many governance standards. Contemporary, SIEM solutions need to be<br />• flexible enough to cater for all devices, operating systems, platforms, databases and application<br />• sufficiently scalable to cope with thousands of devices generating millions of events<br />• intelligent, correlating events and identifying true security incidents only so resources can focus on genuine threats and attacks.</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
This is an introductory 'Top Ten of Audit Trail and Event Log Monitoring'.<br />1. Security Standards and Corporate Governance Compliance Policies such as PCI DSS and GCSx CoCo require logging mechanisms and the ability to track user activities as they are critical in preventing, detecting, or minimizing the impact of a data compromise. Other policies such as FISMA, Sarbanes Oxley, NERC CIP, ISO 27000 and HIPAA all benefit from a means of centralizing audit log events to identify security incidents.</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
2. The state of the art in Audit Log Correlation technology provides automated configuration assessment, proactively testing and assessing a server environment against preconfigured, out-of-the-box policies, helping to enable a minimal deployment window. The best solutions leverage industry standards, specifically benchmarks from the Center for Internet Security (CIS), the National Institute of Standards and Technology (NIST), and the Defense Information Systems Agency (DISA). These benchmarks include thousands of configuration assessments enabling automatic sustainable policy compliance testing for FISMA.</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
3. Security standards such as PCI DSS and GCSx CoCo mandate the need to track and monitor all access to network resources and cardholder data Logging mechanisms and the ability to track user activities. The presence of logs in all environments allows thorough tracking and analysis if something does go wrong. Determining the cause of a compromise is very difficult without system activity logs. A central event log analyzer is the best option to use.</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
4. It is vital that your system for centralizing audit log trails is robust and comprehensive. PCI DSS requires your audit trail history is retained for at least one year with at least 3 months history available for immediate access. The best audit-log tracking software solutions provide real-time indexing of logs with instant keyword search and correlation facilities.</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
5. While Unix and Linux hosts can forward audit trail and system events using syslog, Windows servers do not have an in-built mechanism for forwarding Windows Events and it is necessary to use an agent to convert Windows Event Logs to syslog. The Windows Events can then be collected centrally using your audit log server. Similarly, applications using Oracle or SQL Server or bespoke or non-standard applications do not use syslog to forward events and it is necessary to use an agent to forward events from these applications. Finally, if you are using an IBM z/OS mainframe or AS/400 system you will need further agent technology to centralize event and audit log messages.</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
6. Audit trail history must be securely stored in order to prevent retrospective editing or any tampering. The PCI DSS requires that audit trails are promptly backed up to a centralized log server or media that is difficult to alter. The best centralized log server solutions employ file-integrity monitoring for the log backup files so that any modifications can be detected and alerted.</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
7. Firewalls (Checkpoint, McAfee Sidewinder, Juniper, Netscreen, Cisco ASA, Nokia, Intrusion Protection System (IPS), Intrusion Detection Systems (IDS), routers and RADIUS accounting and authorization services, vulnerability scanning solutions such as Retine eEye, Nessus and other Pen Testing solutions, wireless routers, switches all natively generate syslog messages to report a range of events from the low-level informational logs through to critical events.</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
8. Syslog messages are defined in RFC 3164 and is officially known as the BSD Syslog Protocol. Syslog messages are sent using UDP on port 514 by default although different ports can be used. Syslog messages use a range of Facility Codes and Severity Codes. The Facility Codes range from 0 to 23 and determine the message type. The Severity Codes range from 0 to 7 as follows:</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
0 Emergency: system is unusable<br />1 Alert: action must be taken immediately<br />2 Critical: critical conditions<br />3 Error: error conditions<br />4 Warning: warning conditions<br />5 Notice: normal but significant condition<br />6 Informational: informational messages<br />7 Debug: debug-level messages</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
9. The Security Information and Event Management or SIEM market as defined by Gartner covers the advanced generation of solutions that not only harvest audit logs and provide centralized log server functions but parse event log messages and analyze event logs as they are stored. This allows event logs to be correlated to identify hacker activity and attack patterns and notify IT security teams. The best SIEM systems employ a range of artificial intelligence capabilities to recognize threat signatures by cross-referencing events from IPS, IDS and RADIUS systems, Anti-Virus, Host Integrity Monitoring systems, File Integrity Monitoring software, Firewalls, Active Directory and watching for classic hacker activity such as deletion of log files and "brute force" hacks where repeated/sequential logon failures or bad password events will be generated.</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
<br /></div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
10. The goal for any SIEM solution is to provide comprehensive log harvesting, automatically filter out all 'information only' or 'normal operation' events while placing a spotlight on a manageable list of genuine, serious attack patterns or security incidents. Even a medium sized enterprise can have thousands or hundreds of thousands of events generated by devices in their infrastructure so a properly implemented SIEM system is invaluable.</div>

How To Speed Up a Slow Microsoft Access Database Running Over a Network

Event Log, Audit Log and Syslog messages have always been a good source of troubleshooting and diagnostic information, but the need to b...

The Top Ten of File-Integrity Monitoring

<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhd7Dm4btIIWXqPTmn4ZgY4LN0XyqIlJkyoHxzTgCvVWFsP5NZnIz2WlqStJp8wd0EzyyafI4DCVDkkZaKn1x2ndJfzmEHbnGIEPBDGyH18Tj6mwOxcA7-TzEqXf8uuJENylTTWBL60PQU/s1600/PCI+File+Integrity+Monitoring.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhd7Dm4btIIWXqPTmn4ZgY4LN0XyqIlJkyoHxzTgCvVWFsP5NZnIz2WlqStJp8wd0EzyyafI4DCVDkkZaKn1x2ndJfzmEHbnGIEPBDGyH18Tj6mwOxcA7-TzEqXf8uuJENylTTWBL60PQU/s1600/PCI+File+Integrity+Monitoring.png" /></a></div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
<br /></div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
<br /></div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
The PCI DSS (Payment Card Industry Data Security Standard) specifies the following</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
"Use file-integrity monitoring or change-detection software on logs to ensure that existing log data cannot be changed without generating alerts (although new data being added should not cause an alert)"</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
File or host integrity monitoring software can serve a significant and distinct role in your security policy. Host integrity monitoring software serves as another hurdle for an attacker to defeat and can provide the first indication of a break-in or compromised host. When properly configured and deployed, this type of software is a powerful addition to the layers that defend your infrastructure in depth.</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
File-integrity monitoring is vitally important from a security standpoint for the following reasons</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
<br /></div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
1. File-integrity monitoring must always be combined with other practices such as event log analysis, anti virus, firewalling and intrusion detection/protection systems, remote logging, and keeping your hosts up to date with security patches.</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
2. Host-based monitoring tools such as anti-virus and host intrusion protection systems (HIPS) providing firewall and intrusion protection give granularity that makes attacks visible on the host on which they are installed. However, no one system or application by itself can be trusted with the task of providing assurance of host integrity. For instance, Zero Day Attacks ie newly introduced security vulnerabilities which are either systemic (eg part of the host OS or application) or from malware, mean your AV and HIPS systems cannot always provide protection</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
<br /></div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
3. Whitelisting of processes is an approach which restricts the Host to only run a pre-approved list of processes. Similar to AV and HIPS systems, this is an effective measure to protect your host systems but is not infallible. Whitelists need to be maintained for all versions of all applications which provides a management overhead. In-house developed applications provide a separate challenge.</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
<br /></div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
4. Host systems running secure application environments as required for a PCI DSS estate need to be 'locked down'. File-Integrity Monitoring means that any new files being introduced to, or removed from, the host are detected and alerted. This provides protection from any malware being introduced (eg a Trojan) or any other modification to the host set-up which could introduce a vulnerability.</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
<br /></div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
5. File-Integrity monitoring provides protection not just from malware being introduced to the system, and not just from a hacker attack, where an application has been modified and a vulnerability unwittingly introduced, but also from an internal threat where a trusted employee with administrator rights can bypass your AV and HIPS systems to either introduce a backdoor to your system, or packet sniffing software, or sql injection or cross-site scripting attack. Don't think this could ever happen to you? Read about Heartland Systems about Albert Gonzalez here http://en.wikipedia.org/wiki/Albert_Gonzalez</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
<br /></div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
6. File-integrity monitoring can be used for desktops and servers although in a PCI DSS scenario, the technology is typically aimed at servers handling cardholder data. As a minimum, the System32 folder should be governed as well as key application program folders.</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
<br /></div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
7. It is important to verify all adds, changes and deletions of files as any change may be significant in compromising the security of a host. Changes to monitor for should be any attributes changes and the size of the file.<br />8. The hash for files should also be verified as a unique indentifier. A Secure Hash Algorithm, such as SHA1, is analogous to a DNA Fingerprint of the file. This is important as an application can be changed programmatically while maintaining the filesize. SHA1 produces a unique, 160 bit hash based on the contents of the file.</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
<br /></div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
9. What is the file-integrity baseline? Any file-integrity monitoring system works by comparing file attributes, filesizes and SHA1 hash signatures from one time to another. The assumption therefore is that the initial baseline is for a vulnerability-free, completely uncompromised host and application.</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
<br /></div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
10. Zero Tolerance to unplanned changes is required, so any file-integrity change must be investigated and authorised as a matter of urgency. However, files will need to changed on a regular basis - windows updates appear to arrive at a rate of ten per week, every week, and anti-virus signatures can easily require daily updates. Therefore tightly managed Release Management and Change Management processes need to be in place which is why these processes are also a key dimension of the PCI DSS, section 6.4</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
"Follow change control procedures for all changes to system components. The procedures must include the following: Documentation of impact, Management sign-off by appropriate parties, Testing of operational functionality, Back-out procedures"</div>
<div style="background-color: white; color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
The ITIL Change Management process is an ideal framework to adopt.</div>

The Top Ten of File-Integrity Monitoring

The PCI DSS (Payment Card Industry Data Security Standard) specifies the following "Use file-integrity monitoring or change-de...

PCI File Integrity Monitoring - Five More FAQs for PCI DSS Merchants

<div style="color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjrsO7pF0M-14DFwhDLtR1eKnuU-IhemHDlHb4iKkh0d2NtNCY6ItEyCDbSruqUhvFc3b-kN7HxgNQAhbKS4WJjnoygTqhE7xpN90j1_m1DIocYBAs6w_7j7kvkBUWbN-28PWhOsCCmarI/s1600/PCI+File+Integrity+Monitoring.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjrsO7pF0M-14DFwhDLtR1eKnuU-IhemHDlHb4iKkh0d2NtNCY6ItEyCDbSruqUhvFc3b-kN7HxgNQAhbKS4WJjnoygTqhE7xpN90j1_m1DIocYBAs6w_7j7kvkBUWbN-28PWhOsCCmarI/s1600/PCI+File+Integrity+Monitoring.png" /></a></div>
<div class="separator" style="clear: both; text-align: center;">
<br /></div>
<div style="color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
PCI DSS File integrity monitoring - What are the best options file integrity monitoring and what else do you need to know? How do you implement file integrity monitoring for Windows servers and Unix servers? How do you provide file integrity monitoring for firewall, routers, EPoS devices and servers? How does file integrity monitoring software work and what are the key features to look for? Should a file integrity monitor be agent-based or agentless?</div>
<div style="color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
The following is part two in a two part series listing the Top Ten FAQs for File-Integrity Monitoring that any PCI Merchant should be aware of.<br />
<br />
<strong>1. For Log Files and Databases</strong><br />
Log files will change constantly on a busy server but it is important that log files are only changed in the manner expected. File integrity monitoring must be used in secure environments to protect important audit trails of system access and privilege usage and changes. The key is to only allow log files to increase in size and to alert if any changes are made to monitor for log file changes that may be an attempt to remove or change audit trail information - clearing log files or changing log files is classic hacker activity and should be monitored. Of course, event logs should be backed up centrally on a secure log server as a mandated requirement of the PCI DSS, PCI Requirement 10.<br />
<br />
Similarly database files containing card data and personal information must be protected and an audit trail of all access and changes created. Again, database files will change constantly so the SHA1 approach will not be suitable. When using file integrity monitoring for SQL Server or file integrity monitoring for Oracle databases the best option is to log access and changes to specific tables and backup event logs centrally on your secure PCI DSS log server.<br />
<br />
<strong>2. For System32 Folder</strong><br />
The most critical system files on a Windows server or EPoS till to monitor for file-integrity are within the WindowsSystem32 folder. All critical operating system programs, dll files and drivers reside within this location and it is therefore an ideal location for Trojans to reside. The threat is that a Trojan could be implanted onto the EPoS device or Card Data Handling Server (evading Anti-Virus detection because AV is only typically 70-90% effective). A file integrity monitor agent will gather a full inventory of all files within the System 32 folders and then make regular comparative checks subsequently to detect any changes made. Trojans are particularly difficult to find ordinarily because they masquerade as regular System32 program files, so they look and appear to act like the genuine program.<br />
Similarly for Linux file integrity and Unix file integrity, all key program file systems such as the /usr/sys and /bin must be checked for integrity using a Linux or Unix file integrity monitor.<br />
<br />
<strong>3. For Windows Updates</strong><br />
Windows Updates and patches for other applications will almost always involve updating program files, drivers and dll files. It is rarely clear which files will be modified by a patch and therefore any updates may generate numerous file changes across many folders and locations. Therefore it is vital that, while your file integrity monitor may track detailed changes to any one of a wide range of file attributes, you can also get good 'at a glance' summary information regarding whether a file has been added, deleted or changed.<br />
<br />
<strong>4. Card Data and Card Data Folder File Integrity Monitoring</strong><br />
Where card data or other sensitive financial information is stored on an EPoS device or server the first line of defense is to limit access via folder and file rights and permissions. Even then, any user with Administrator rights will still be able to view the data and potentially copy out card numbers.<br />
Therefore the best line of defense is to implement object access auditing on the file or folder. This will generate a full audit trail logging all access to the folder including the user account used to do so. Processing this audit trail with an intelligent, PCI event log analyzer will then ensure any unexpected access to the card data will generate an alert. For example, defining a rule to automatically distinguish between normal operations e.g. local system account access compared to a named account with administrator access.<br />
<br />
<strong>5. PCI File Monitoring and Planned Changes/Change Acknowledgment</strong><br />
Of course, changes will need to be made to configuration files and system files every once in a while. It is important to keep security patches up to date and the PCI DSS mandates this should happen every month.<br />
Operating a formal Change Management process is a key element of any IT security policy and therefore it is vital that your file integrity monitoring solution takes account of intended, planned changes. Any file changes detected as part of a planned change should be verified as part of your QA Testing and post implementation review processes to confirm that the right changes happened to the intended files only.<br />
<br />
What about unplanned changes that are either emergency changes or those that for some reason bypass the change management process? These will all be detected and alerts raised by the file integrity monitor but there then needs to be an incident management process to investigate and either approve the changes or remediate them. The PCI DSS is not prescriptive as to how these processes should be managed so for some organizations they will use a full Service desk application to document and approve changes, whereas smaller organizations may just need a spreadsheet record of changes - use what works best for your company, not what you think a QSA will expect to see!<br />
See part one of this series for other important file-integrity monitoring FAQs that any Merchant needing to be PCI DSS compliant should know</div>
<div style="color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
<br /></div>

PCI File Integrity Monitoring - Five More FAQs for PCI DSS Merchants

PCI DSS File integrity monitoring - What are the best options file integrity monitoring and what else do you need to know? How do you...

SQL DBA Tip - Using Perfmon Counters in SQL Profiler

<div style="color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
A great technique for troubleshooting SQL Server performance issues is to make use of both Perfmon and SQL Profiler together. Each of these tools on their own can give you insight into what is happening on your database server, but when combined they can clearly narrow down your performance bottleneck to specific events or statements that you can then focus on to resolve the performance problem.</div>
<div style="color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
First thing you need to do is to set up your Perfmon and save its results to a file. You do this by right clicking on trace logs, and then adding the counters that you want to monitor, then click on the log files tab and choose your output type. I always choose the .CSV output because it can then be easily used for other purposes as well.<br />
Next you will want to set up your SQL Profiler to trace the events that you want to monitor. The built in templates are fine for this purpose, just choose the one that best matches the type of problem that you are trying to troubleshoot for. Choose the option to save your trace results to a file and specify where you want the file to be saved.<br />
Now that you have both your Perfmon and Profiler set up and ready to go just start them both and monitor for the event you are troubleshooting. Once it has occurred then stop Perfmon and Profiler. Open Profiler back up and load the output file from the path you specified when you set up the Profiler trace. Now you want to add the data you gathered from Perfmon. To do this you click on File, then Import performance data. Browse to where you saved the Perfmon log and double click on it. A dialogue box will open asking you to choose which counters you want to display. Pick your counters and then click OK.<br />
You will now see the Perfmon graph above the SQL Profiler trace window in Profiler. Now all you have to do is click on the Perfmon graph where your event has taken place and you will see the Profiler window automatically scroll to that same point in time. For example, if you were troubleshooting a spike in CPU activity you would click on the Perfmon graph where you see the CPU spike begin and then the Profiler window will scroll down to the corresponding time and you will now be able to see exactly what statements were running in SQL Server at that time. Now you can focus on those statements to help correct the performance bottleneck.<br />
Using Perfmon and SQL Profiler together can be a powerful combination to help you resolve performance issues on your SQL Server. Use this technique on a regular basis to keep your database server operating at peak efficiency.</div>

SQL DBA Tip - Using Perfmon Counters in SQL Profiler

A great technique for troubleshooting SQL Server performance issues is to make use of both Perfmon and SQL Profiler together. Each of these...

Pandora FMS PosgreSQL Monitoring

<div style="color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjAKSozHZh8piSsk5maa15To2R86gqeXOlXMGH0MVKe7entYgb1AQbHMxbQI2x0uZNLKUGshgrpyQ3qbQk49fOdxHF4wZcQd1v3m3SFjibggF6wMHwSvl9_ABmndx4hApd5-yu9jQOZyxM/s1600/pandora-fms.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjAKSozHZh8piSsk5maa15To2R86gqeXOlXMGH0MVKe7entYgb1AQbHMxbQI2x0uZNLKUGshgrpyQ3qbQk49fOdxHF4wZcQd1v3m3SFjibggF6wMHwSvl9_ABmndx4hApd5-yu9jQOZyxM/s1600/pandora-fms.jpg" /></a></div>
<span id="goog_2038667937"></span><span id="goog_2038667938"></span><br /></div>
<div style="color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
<br />
In order to get the software working at peak performance and make a better use of your resources, it is essential to optimize the parameters of Progress. <strong>Optimizing is important, but optimizing without monitoring is completely useless. </strong>With a tool that monitors your systems, <strong>you will be notified on problems before they become a bigger issue</strong>. If an error occurs in your database, you will receive an email with all the information so you can solve it before it's too late.</div>
<div style="color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
A monitoring system will let you know about when, where and why a problem occurred. With a good optimization and monitoring of ProgreSQL, this database will be suitable even for large companies.<br />
<strong>All these things will provide you with a better user experience and reliability</strong>. It will even reduce the time spent on maintenance of PostgreSQL and, therefore, you will cut down on costs and time.<br />
<strong>COLLECTION OF INTERESTING DATA</strong><br />
There are several tools from Linux / Unix that collect useful information about the impact of PostgreSQL in the system. We will talk about some of them below.<br />
* ps<br />
With command, which most of Linux / Unix systems includes, you can get information about the CPU usage, RAM PostgreSQL processes, the client connections to the server and its activity, among many other things.<br />
For example, with a query as the one below:<br />
<blockquote>
<br />
ps aux | grep "postgres" | grep -v "grep"</blockquote>
We would get this information:<br />
<blockquote>
<br />
postgres 1289 0.0 0.3 51676 7900? S 11:31 0:01 /usr/lib/postgresql/9.1/bin/postgres -D /var/lib/postgresql/9.1/main -c config_file=/etc/postgresql/9.1/main/postgresql.conf</blockquote>
postgres 1303 0.0 0.0 21828 1148? Ss 11:31 0:00 postgres: logger process<br />
postgres 1305 0.0 0.0 51676 1568? Ss 11:31 0:02 postgres: writer process<br />
postgres 1306 0.0 0.0 51676 1324? Ss 11:31 0:02 postgres: wal writer process<br />
postgres 1307 0.0 0.1 52228 2452? Ss 11:31 0:00 postgres: autovacuum launcher process<br />
postgres 1308 0.0 0.0 22016 1432? Ss 11:31 0:00 postgres: stats collector process<br />
The third and fourth columns show the percentage of CPU usage and RAM, respectively. Since a very high consumption of CPU and RAM can cause slowness and server crashes, it is important to pay attention to these two data.<br />
Note that if data appear when performing this query, it means that the PostgreSQL server is active.<br />
* Vmstat:<br />
With this command (included in most of the facilities of Linux / Unix systems) you can obtain data related to the common memory and SWAP, (at the entrance and exit), the system and the CPU. The first line always shows an average since the last reboot.<br />
To get a view of the current data during an interval of time with a defined number of repetitions, you can perform a query like the one below, where the first variable shows the time in seconds that will measure each line, and the second variable shows the number of lines that will appear:<br />
<blockquote>
vmstat 1 5</blockquote>
It will return information like this:<br />
<blockquote>
procs ----memory---- -swap- --io-- -system- --cpu--</blockquote>
r b swpd free buff cache si so bi bo in cs us sy id wa<br />
0 0 0 188972 179496 669392 0 0 24 27 525 461 1 1 96 1<br />
0 0 0 188972 179496 669392 0 0 0 0 1449 1689 2 2 97 0<br />
0 0 0 188972 179496 669392 0 0 0 0 2403 1605 2 2 97 0<br />
2 0 0 188972 179500 669392 0 0 0 16 2041 2502 2 3 94 2<br />
0 0 0 188972 179500 669392 0 0 0 0 1599 1868 1 1 98 0<br />
The most useful information to the topic that concerns us is shown in the last column: "wa". It shows the timeout for Input / Output operations. Since the system could "collapse " due to an excessive disk access, it is very important to monitor it so it will not exceed a value of 15-20.<br />
Check if the values of the columns "si" and "so" of the SWAP memory usage are 0. It would mean that the Ram memory of the server is saturated.<br />
* netstat<br />
This command displays information about the status of the network connections, so you can check the number of standby connections in the computer hosting the PostgreSQ, with a query like the one below.<br />
<blockquote>
netstat -ntu | grep "TIME_WAIT" | wc -l</blockquote>
A high number of "standby connections" may indicate problems with the server response as a result of other problems.<br />
** Views and internal tables of PostgreSQL<br />
PostgreSQL has a subsystem called Statistics Collector responsible for collecting and reporting information on the activity of the server. To deactivate Statistic Collectors and avoid performance losses, modify the parameters ' track_counts ', ' track_functions ' and ' track_activities ' on the file ' postgresql.conf '. However, before deactivating it, you must assess whether it is worthwhile as this will remove the possibility of obtaining very useful data.<br />
To access these data, you need SQL to perform several queries to some predefined views. Some of the most important ones are:<br />
* pg_database<br />
It saves information about the databases available. A database per row.<br />
This table is very interesting because it will allow you to find out the size ( in bytes ) of all the databases. The " pg_database_size ( oid ) " returns the size of the database whose ID is passed as an argument. By performing a query on this table, it will show the size of each database, row by row, and you will only have to add the results to see if there is enough space left in the disk:<br />
<blockquote>
SELECT SUM(pg_database_size(oid)) FROM pg_database;</blockquote>
* pg_locks<br />
* pg_locks displays information on the active locks in the server. It has one row for each lock, which display information about the type of lock and where it has occurred, etc.<br />
As the SGBD allows multiple users to access at the same time, some of them may want to make changes on the same item that is being used by another user. To avoid this situation, the elements in use in a transaction must be locked. To find out the number of locked element, perform the following query:<br />
<blockquote>
SELECT COUNT(*) FROM pg_locks;</blockquote>
A high number of locks could decrease the server performance, because two or more processes could try to access the same resource and would have to wait for the resource to be unlocked.<br />
* pg_stat_activity: it shows information about the server processes. It shows a row per process.<br />
From this view you can get the number of users connected to the query:<br />
<blockquote>
SELECT COUNT(usename) FROM pg_stat_activity;</blockquote>
The number of concurrent users that can manage the system depend on the hardware and the connection of the machine where the server is located. It is convenient to perform stress tests to find out what that limit is and be alerted if the system is reaching it.<br />
* pg_stat_database<br />
It shows information about the use of databases. It has one row for each database, which shows the number of connected processes, commits and rollbacks. Furthermore, it shows information on the blocks read from the disk, the cache and the number and type of operations performed with rows of each one.<br />
With this table you can find out, for example, if the cache memory is working properly. With the query below, you can get a usage rate of the cache with respect to the common:<br />
<blockquote>
SELECT SUM(blks_hit) / SUM(blks_read) FROM pg_stat_database;</blockquote>
The higher ratio, the greater speed when collecting data for the tables.<br />
* pg_stat_bgwriter<br />
It only has one row and shows data related to checkpoints and buffers from the background writer.<br />
An advanced user able to interpret data can take advantage of this information by changing certain properties to improve the performance. For example, you can perform this query:<br />
<blockquote>
SELECT maxwritten_clean FROM pg_stat_bgwriter;</blockquote>
This query will return the number of times that the bgwriter has overwritten the maximum number of buffers allowed in that round, when a checkpoint has been performed. A low number is OK, but if the values are too high, you should increase the value ' bgwriter_lru_maxpages ' (default 100 ) in ' postgresql.conf ' or the command line to improve the performance.<br />
You can also improve the performance by checking what external processes are forced to ask for more space many times in the buffers.<br />
Use this query to check it:<br />
<blockquote>
SELECT buffers_backend FROM pg_stat_bgwriter;</blockquote>
To expand the space before a process needs to extend it, you can increase the values ' bgwriter_lru_maxpages ' and ' bgwriter_lru_multiplier ', and reduce the value ' bgwriter_delay '.</div>
<div style="color: #333333; font-family: Georgia, 'Times New Roman', 'Bitstream Charter', Times, serif; font-size: 16px; line-height: 24px;">
<br />
<br /></div>

Pandora FMS PosgreSQL Monitoring

In order to get the software working at peak performance and make a better use of your resources, it is essential to optimize the para...