log activity. intrusion detection. user event notification ( interraction ). messaging
- by Julian Davchev
Have three questions that I somehow find related so I put them in same place.
Currently building relatively large LAMP system - making use of messaging(activeMQ) , memcache and other goodies.
I wonder if there are best practices or nice tips and tricks on howto implement those.
System is user aware - meaning all actions done can be bind to particular logged user.
1. How to log all actions/activities of users? So that stats/graphics might be extracted later for analysing.
At best that will include all url calls, post data etc etc. Meaning tons of inserts. I am thinking sending messages to activeMQ and later cron dumping in DB and cron analysing might be good idea here.
Since using Zend Framework I guess I may use some request plugin so I don't have to make the log() call all over the code.
2.How to log stuff so may be used for intrusion detection?
I know most things might be done on http level using apache mods for example but there are also specific cases like (5 failed login attempts in a row (leads to captcha) etc etc..)
This also would include tons of inserts. Here I guess direct usage of memcache might be best approach as data don't seem vital to be permanantly persisted. Not sure if cannot use data from point 1.
3.System will notify users of some events.
Like need approval , something broke..whatever.Some events will need feedback(action) from user, others are just informational. Wonder if there is common solutions for needs like this.
Example: Based on occuring event(s) user will be notifed (user inbox for example) what happend. There will be link or something to lead him to details of thingy that happend and take action accordingly.
Those seem trivial at first look but problem I see if coding it directly is becoming really fast hard to maintain.
