Syslog

Snapshot the virtual machine, memory included, before any reboot.

Rely on firewall, proxy, and Syslog records held elsewhere.

Hunt for unexpected administrator role changes, unticketed accounts, and gaps in log forwarding.

Treat any internet-reachable appliance on Remote Support 26, 2, 3, or earlier as potentially compromised, and rotate credentials only after patching or rebuilding, or the attacker collects the new ones.

Block outbound traffic from the appliance.

The awkward question for UK directors is not whether you patch, but whether you would know.

If your remote access tool fell in August, would logs held somewhere the attacker couldn't reach have told you by October? The answer costs a Syslog server and an afternoon.

The alternative costs an incident.

They...

Observabili- they have Syslog, they have Journaling, they have a lot of information about what these systems are doing.

But unfortunately, [laughs] they don't have a lot of information about what the agents are doing.

Yeah.

Yeah.

It's lo- it's a log with context and intention.

Imagine trying to take all the logs, to your point about Syslog.

So let's imagine you're literally just piping this stuff directly out of Syslog.

They...

Observabili- They have Syslog, they have Journaling, they have a lot of information about what these systems are doing.

But unfortunately, [laughs] they don't have a lot of information about what the agents are doing.

Yeah.

Yeah.

It's lo- it's a log with context and intention.

Imagine trying to take all the logs, to your point about Syslog.

So let's imagine you're literally just piping this stuff directly out of Syslog.

They...

Observabili- They have Syslog, they have Journaling, they have a lot of information about what these systems are doing, but unfortunately [laughs] they don't have a lot of information about what the agents are doing.

Yeah.

So it's basically a log of agent actions.

Yeah.

It's lo- it's a log with context and intention.

Imagine trying to take all the logs, to your point about Syslog.

So let's imagine you're literally just piping this stuff directly out of Syslog.

Because nothing on the market replaces it in one move.

There's a project called Service Radar, open source, posted to Hacker News last October, that's explicitly built to bridge legacy SNMP and Syslog with modern gNMI and OpenTelemetry.

The claim is scaling to a hundred thousand devices and ninety million events per second.

That's the shape of the tooling that's actually being built, not SNMP replacement.

They...

Observabili- they have Syslog, they have Journal of Co- they have a lot of information about what these systems are doing, but unfortunately [laughs] they don't have a lot of information about what the agents are doing.

Yeah.

So it's basically a log of agent actions.

Yeah.

It's lo- it's a log with context and intention.

Imagine trying to take all the logs, to your point about Syslog.

So let's imagine you're literally just piping this stuff directly out of Syslog.