Search Results for "kernel"

...Osquery exposes an operating system as a high-performance relational database. This allows you to write SQL queries to explore operating system data. With osquery, SQL tables represent abstract concepts such as running processes, loaded kernel modules, open network connections, browser plugins, hardware events or file hashes.Osquery queries your devices like a database. Osquery uses basic SQL commands to leverage a relational data-model to describe a device. Frequently, attackers will leave a malicious process running but delete the original binary on disk. This query returns any process whose original binary has been deleted, which could be an indicator of a suspicious process.

ttyrpld is a multi-OS kernel-level TTY keylogger and screenlogger with (a)synchronous replay support. It runs on Linux, Solaris, FreeBSD, NetBSD and OpenBSD.

...It is multi-threaded, scalable and versatile with features designed for both network and host managers. Each Syslogd2 binary is customized from a set of over 20 features at compile-time. It can support input from text files, named-pipes, Linux kernel and user-defined Linux and (both IPv4 and IPv6) IP sockets (both UDP and TCP). It provides a pre-loadable name-cache that can replace DNS services for host-name resolution. Syslogd2 easy-to-use filters use string-matching to select messages which can then be modified, dropped, kept or re-routed (changed to new facilities). Filters are applied to inputs, outputs or both to control msg-routing and network load. ...

A Linux kernel module to grab keys pressed in the keyboard, or a keylogger. keysniffer was initially written with the US keyboard (and conforming laptops) in mind. By default it shows human-readable strings for the keys pressed. However, as keyboards evolved, more keys got added. So the module now supports a module parameter codes which shows the keycode shift_mask pair in hex (codes=1) or decimal (codes=2).

ClamFS is a FUSE-based user-space file system for Linux with on-access anti-virus file scanning through clamd daemon. ClamFS has moved to Github. Please navigate to github.com/burghardt/clamfs.

...It can collect logs from files in various formats, receive logs from the network remotely over UDP, TCP or TLS/SSL . It supports platform specific sources such as the Windows Eventlog, Linux kernel logs, Android logs, local syslog etc. Writing and reading logs to/from databases is also supported. The collected logs can be stored into files, databases or forwarded to a remote log server using various protocols. The old BSD Syslog and the newer IETF syslog standard is fully supported by NXLog in addition to Snare, XML, JSON, GELF, KVP, CSV and custom formats. ...

Over Monitor is a Web App for Smartphone that can check the status of your server. The application was created to monitor your server even when you not have of your PC, with a smartphone you can check the status of the server.

nf_quota is an ip-based traffic accounting project. IPs can be added to users. It provides a kernel module that hooks onto netfilter and counts every packet passing a specified interface. If the quota for a ip/user is exceeded, the packet is dropped.

Kapacity is a tool for KDE for showing the ACPI battery state, AC state and CPU state in a window. It can also dock into the panel. It can handle CPU with CPU FREQ. It based on the ACPI Subsystem for Kernel 2.4 und 2.6

...You have to customize syslog-ng to include severity as the first character in each logged line, and to pipe the logged messages through the logcolourer program. You can use the program to colour any file according to digits in the first character of each line. logcolourer can also process lines from the linux kernel, though these normally get routed via syslog-ng anyway.

Netconsole2Mail is simple python based daemon that receives netconsole messages from kernel on configured hosts and sends them to administrator in configured pooling interval. Only new messages are sent.

This project involves adding code to the Linux kernel to implement crash dumps for performing post-failure analysis of a kernel crash.

We provide a mechanism to trace the NPTL Library as few intrusive as possible for the application dynamics. The post-mortem analysis then allows measurements (contension,...) and understanding of hangs or bugs. No change in kernel or user application.

Klogger is a framework for post mortem analysis of the Linux kernel behavior. Offering low overhead and flexibility, it allows researchers to analyze performance without the need for extensive kernel knowledge.

Uberviewer is a java/swt log processor for Uberlogger (a kernel-based observatory). It allows real-time analysis of a remote OS, including process and I/O monitoring. This tool is intended to be helpful for security researchers and malware analysts.

IP Traffic Volume: Logs (counts) in- & outgoing bytes through network device(s) using kernel iptables. Highly configurable as to which bytes are logged, e.g. to/from specific ports or ip-addresses. Data displayed in html via cgi or plain ascii to console

IP accounting tools package based on Berkeley Packet Filer mechanism. Continue from BPFT by V.Vorobyev, TRAFD by V.Belekhov & S.Svirid. Use the PCAP library to implement connection to bpf kernel pseudo-device.

Syscall logger is a Linux kernel patch which enables logging of the selected syscalls using syslog.

USRBAC is a kernel patch and userspace daemon that allows role based access control to be mitegated in userspace. The goal is to allow a secure way to impliment RBAC compliant security systems using a daemon in userspace

Status Module is a daemon which forwards vital system information (memory usage, active processes, etc.) into the kernel logs by using a kernel module. This is very useful for logging or security purposes.

KISS is a kernel-side host-oriented security tool, which may bring you file integrity checking, file and process hiding and actions handling on special internal events (using a tiny scripting language).

A linux kernel module and supporting user space environment which allow interception and modifying system calls that match user defined criteria. Think of it as strace on steroids.

ProSum is a terminal based program that protects your files, sys_call_table and IDT like tripwire way (All in user space, without kernel modules) In addition, database with files etc. could be encrypted with Blowfish algorythm and more.