Splunk! (Google Splunk)
They have a free version for up to 500 MB a day in logs, which actually
for a small/medium biz is ok.
And the pay version isn't too badly priced either.
Very easy to setup, and supports many different ways to alert and filter
logs.
If you have Windows servers, then you can use Snare clients to send the
event logs as syslog messages to it. Works great!
Kiwi as also pretty nice.
-Petter
-----Original Message-----
From: listbounce@securityfocus.com [mailto:listbounce@securityfocus.com]
On Behalf Of Lee Hilt
Sent: Friday, January 18, 2008 11:19 AM
To: 'Krzyston, Randy'; security-basics@securityfocus.com
Cc: listbounce@securityfocus.com
Subject: RE: Logging
If you are simply looking for a storage solution, (logs in, emails on
threshold of error rates, etc) Kiwi would be the way to go.
If you are looking for a more granular look, along with searchable
questions like "Show me accounts with a high incidence of password
failures" and other questions, your solution might best be serviced by
http://manageengine.adventnet.com/products/eventlog/index.html
Pricing is kinda high, but it is a pretty good product.
-----Original Message-----
From: listbounce@securityfocus.com [mailto:listbounce@securityfocus.com]
On Behalf Of Krzyston, Randy
Sent: 2008-01-18 1:19
To: security-basics@securityfocus.com
Cc: listbounce@securityfocus.com
Subject: Logging
We are looking to implement a syslog server. It needs to not only be
capable of storing logs ,but also detailed reporting for things such as
SOX.
I've looked at LogLogic's products. I also heard about Kiwi, but have
not experience with it.
Any comments?
Randy
