If you are going to pay for something check this out:

http://www.manageengine.com/products/eventlog/index.html

I started using it after kiwi started to charge for some of the features
I needed. With the product above you can also dump server event logs
without installing an agent. Easy to sort and preview when you have many
logs.

-----Original Message-----
From: listbounce (at) securityfocus (dot) com [email concealed] [mailto:listbounce (at) securityfocus (dot) com [email concealed]]
On Behalf Of Hindley Nick
Sent: Monday, June 01, 2009 12:05 PM
To: 'sec (at) nd-f (dot) com [email concealed]'; security-basics (at) securityfocus (dot) com [email concealed]
Subject: RE: log analyser

we're using snare and kiwisyslog

-----Original Message-----
From: listbounce (at) securityfocus (dot) com [email concealed] [mailto:listbounce (at) securityfocus (dot) com [email concealed]]
On Behalf Of sec (at) nd-f (dot) com [email concealed]
Sent: 29 May 2009 00:26
To: security-basics (at) securityfocus (dot) com [email concealed]
Subject: log analyser

Hi,

can someone of you recommend a good enterprise log analyser solution? i
have to collect, corrolate and analyse about 1200 windows machines and
200 linux boxes. i want to do this in real-time, trigger actions (like
email notification), make sense out of e.g. ten failed login attempts
following the one successful etc.

any hint would be helpful
thanks
andy

------------------------------------------------------------------------

This list is sponsored by: InfoSec Institute

Need to pass the CISSP? InfoSec Institute's CISSP Boot Camp in both
Instructor-Led and Online formats is the most concentrated exam prep
available. Comprehensive course materials and an expert instructor means
you pass the exam. Gain a laser like insight into what is covered on the
exam, with zero fluff!

http://www.infosecinstitute.com/courses/cissp_bootcamp_training.html
------------------------------------------------------------------------

------------------------------------------------------------------------

This list is sponsored by: InfoSec Institute

Need to pass the CISSP? InfoSec Institute's CISSP Boot Camp in both
Instructor-Led and Online formats is the most concentrated exam prep
available. Comprehensive course materials and an expert instructor means
you pass the exam. Gain a laser like insight into what is covered on the
exam, with zero fluff!

http://www.infosecinstitute.com/courses/cissp_bootcamp_training.html
------------------------------------------------------------------------

------------------------------------------------------------------------

This list is sponsored by: InfoSec Institute

Need to pass the CISSP? InfoSec Institute's CISSP Boot Camp in both Instructor-Led and Online formats is the most concentrated exam prep available. Comprehensive course materials and an expert instructor means you pass the exam. Gain a laser like insight into what is covered on the exam, with zero fluff!

http://www.infosecinstitute.com/courses/cissp_bootcamp_training.html
------------------------------------------------------------------------

[ reply ]