-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Do you make use of the audit logs? They will log a username along with a
session id enabling you to identify evil sessions by user, but
importantly, the audit logs are purged away at a specified interval.  I
think it defaults to 7 days, but you could decide what purge interval
would be sufficient for your forensics needs. When vendors are notifying
you of malicious activity, it is likely to be within a day or two of the
activity so you might consider keeping your audit log for just 3-4 days.

After the audit log has been rotated away, you no longer have a link 
between user ids and the EZproxy session (which I assume you are logging).

Of course, they would still hang around in backups.

http://oclc.org/support/services/ezproxy/documentation/example/securing.en.html

On Wed, 19 Nov 2014, Joshua Welker said:

>    Balancing security and privacy with EZproxy
> 
> In recent months, we have been contacted several times by one of our
> vendors about our databases being accessed by rogue Chinese IP addresses.
> With the massive proliferation of online security breaches and password
> dumps, attackers are gaining access to student accounts and using them to
> access subscription resources through EZproxy. The vendor catches this
> happening and alerts us sometimes, but probably more often than not we have
> no idea. When we do find out, we force the students to change their
> passwords.
> 
> We currently log IP addresses in EZproxy and can see when one of these
> rogue IP addresses is accessing a resource. However, we do not log user IDs
> in EZproxy, so we can’t tell which student account was compromised. Logging
> the user IDs would be a quick fix, but it has major privacy implications
> for our patrons, as we would have a record of every document they access.
> Have any other institutions encountered this problem? Are any best
> practices established for how to deal with these security breaches?
> 
> I apologize for cross-posting.
> 
> Josh Welker
> Information Technology Librarian
> James C. Kirkpatrick Library
> University of Central Missouri
> Warrensburg, MO 64093
> JCKL 2260
> 660.543.8022

- -- 
++++++++++++++++++++
Michael Berkowski
University of Minnesota Libraries
[log in to unmask]
612.626.6137
PGP Public Key: http://z.umn.edu/mjbpubkey
++++++++++++++++++++

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iEYEARECAAYFAlRtBYYACgkQ01KJk46VC2YDAwCeM1gZH25iP+44RLqn0onooU7A
wsIAnisnbl3hZcgIknMsPyseCnHo71dQ
=gj8M
-----END PGP SIGNATURE-----