A XYZ security System Administrator is reviewing the network system log files.

He should contact the attacker’s ISP as soon as possible and have the connection disconnected.

He should log the event as suspicious activity, continue to investigate, and take further steps according to site security policy.

He should log the file size, and archive the information, because the router crashed.

He should run a file system check, because the Syslog server has a self correcting file system problem.

He should disconnect from the Internet discontinue any further unauthorized use, because an attack has taken place.