LogAnalysis
[logs] Eventlog to syslog Feb 29 2008 12:59PM
Marcelo de Souza (marcelo marcelosouza com) (3 replies)
Re: [logs] Eventlog to syslog Mar 06 2008 10:49PM
Anton Chuvakin (anton chuvakin org) (1 replies)
[logs] SYSLOG patent? Mar 12 2008 08:16AM
A Ananth (ananth802 yahoo com) (1 replies)
Re: [logs] SYSLOG patent? Mar 14 2008 11:18AM
Stefano Zanero (zanero elet polimi it) (1 replies)
Re: [logs] SYSLOG patent? Mar 14 2008 04:22PM
Balazs Scheidler (bazsi balabit hu) (4 replies)
Re: [logs] SYSLOG patent? Mar 15 2008 03:15AM
Bill Scherr IV (bschnzl cotse net) (1 replies)
Re: [logs] SYSLOG patent? Mar 15 2008 11:29PM
Marcus J. Ranum (mjr ranum com)
Re: [logs] SYSLOG patent? Mar 14 2008 08:13PM
Stephen John Smoogen (smooge gmail com)
RE: [logs] SYSLOG patent? Mar 14 2008 06:22PM
Rainer Gerhards (rgerhards hq adiscon com) (2 replies)
RE: [logs] SYSLOG patent? Mar 14 2008 06:46PM
Dee-Ann LeBlanc (dee splunk com)
Re: [logs] SYSLOG patent? Mar 14 2008 06:44PM
Ray Van Dolson (rvandolson esri com)
RE: [logs] SYSLOG patent? Mar 14 2008 06:15PM
Rainer Gerhards (rgerhards hq adiscon com)
Re: [logs] Eventlog to syslog Feb 29 2008 07:37PM
Anton Chuvakin (anton chuvakin org) (2 replies)
RE: [logs] Eventlog to syslog Feb 29 2008 09:06PM
Rainer Gerhards (rgerhards hq adiscon com)
Re: [logs] Eventlog to syslog Feb 29 2008 08:33PM
Daniel Cid (dcid ossec net)
Re: [logs] Eventlog to syslog Feb 29 2008 07:27PM
tbird precision-guesswork com (2 replies)
Re: [logs] Eventlog to syslog Feb 29 2008 09:10PM
David Corlette (DCorlette novell com) (1 replies)
[logs] wny not syslog on microsoft platforms Feb 29 2008 11:13PM
Rodney Thayer (rodney canola-jones com)
Re: [logs] Eventlog to syslog Feb 29 2008 08:52PM
Rodney Thayer (rodney canola-jones com) (2 replies)
Re: [logs] Eventlog to syslog Feb 29 2008 11:02PM
Anton Chuvakin (anton chuvakin org) (1 replies)
Re: [logs] Eventlog to syslog Feb 29 2008 11:49PM
Marcus J. Ranum (mjr ranum com)
Re: [logs] Eventlog to syslog Feb 29 2008 10:17PM
tbird precision-guesswork com (4 replies)
RE: [logs] Eventlog to syslog Mar 03 2008 09:53PM
Desai, Ashish (Ashish Desai fmr com)
Re: [logs] Eventlog to syslog Mar 03 2008 07:08PM
Patrick Hull (nethead69 gmail com) (2 replies)
On 2/29/08, tbird (at) precision-guesswork (dot) com [email concealed] <tbird (at) precision-guesswork (dot) com [email concealed]> wrote:
> Quoting Rodney Thayer <rodney (at) canola-jones (dot) com [email concealed]>:
>
> > I'd like to just know why they don't support syslog.
> > Heard rumors Longhorn would fix that bug ;-)
>
> Hmm. I've apparently heard contradicting rumors. We should compare
> notes some time.
>
> > Anyway, my point is, if that vendor (e.g. Microsoft)
> > thinks they have a reason for not doing syslog to support
> > external event management, I'd be interested in hearing that.
> > I think not doing syslog is broken but what I think we all
> > really see as a requirement is "externally available interoperable
> > standards-based event output" so I try to have an open mind
> > when this MS flaw is revisited...
>
> Here's my 0.02, as politically correctly as I can put it: Microsoft
> has a corporate tradition of building closed systems, and even when
> they're forced to build a standards-based application (DNS? IPsec?)
> they have a tendency (that's polite) to add extensions that make their
> products less interoperable than one might like. Ahem. One with a
> truly heterogeneous network to run, anyhow.

I agree Tina. My background is UNIX, and I am currently building a syslog-based
logging/monitoring infrastructure for my company, and struggling with the MS
event log (and other MS logs) issue. We are currently evaluating Snare and
Splunk to see what it can do for us. We are also using a combination
of syslog-ng,
stunnel, SEC, and some other perl scripts.

Our MS folks have deployed MOM in some secure environments. They also use an
old version of the Dorian product to monitor security event logs. I
know very little
about MOM, but have asked our MS folks on several occasions what they can do
with it. They claim it can do a lot, but I have not seen anything
supporting that
statement in practice yet, and I suspect it is like any other
monitoring tool - it
takes a lot of tweaking and twiddling to get some useful info out of
it. However, a
quick google implies that MS MOM can be configured as a "receiver" of syslog
msgs:

http://support.microsoft.com/kb/297443

I think this aligns with your perspective - this is an example of the
way MS supports
syslog... just as they embrace and extend DNS and IPSEC. Providing a solution
that "sends" event logs to another platform's syslog server does not
establish the
MS solution in a central player position, but providing a solution that can only
"receive" syslog *does*, potentially positioning MOM as the enterprise MS SIEM
solution. I guess I would expect no less from them. So they do appear
to offer an
interoperable syslog-based solution... it just interoperates in one direction ;)

I am not interested in this solution personally, but I can already
hear management
suggesting that we evaluate this "solution". Just curious if anyone
on the list has
done anything useful (or really had any experiences at all) with MOM?
Considering
the background of most on this list I would suspect not, but worth asking...

>
> On the specific beloved topic of syslog, I know (cos I've been part of
> it) that Microsoft has heard "support syslog" for years. The problem
> is that they're hearing it from UNIX experts and IETF folks and people
> on this list, very few (if any) of whom have enterprise-scale
> deployments of Microsoft products deployed, and even fewer of whom
> (out of that "any") who would *not* deploy an MS product because it
> did NOT support syslog.
>
> Microsoft responds to its customers. Microsoft responds more swiftly
> to customer pressure than any other IT vendor I've ever dealt with.
> (Pressure from the press doesn't hurt, either, but I can't imagine how
> we could turn decades of lack of support for syslog into a slashdot
> worthy news event.)
>
> If we *really* want to get MS' attention on this issue, we need to
> find some large Microsoft customers who are willing to apply pressure
> to their account managers about syslog support. That's certainly
> *possible*, but I suspect it's highly unlikely, cos' most of the large
> MS shops I've worked at/with are already using MS-provided or
> Windows-specific monitoring tools, and can't even *spell* syslog.
>
> So the real question becomes: of those large MS customers, how many of
> them have or are planning to deploy a syslog-based monitoring
> infrastructure, and are they willing to apply pressure to Redmond?
> Anyone here an MS Premier customer?
>

My employer is one of those large M$ Premier customers, though we have an
equally large base of UNIX/Linux/Network devices that speak syslog natively.
We recently met with MS to discuss a number of things, and their lack of support
for syslog was one of the questions. I will let you know the response
if/when we
receive one ;) I have my suspicions that it will involve the use of
MOM. Thus my
interest in other's experiences with MOM as a heterogeneous SIEM tool.

I realize I am diverging a bit from the original discussion of MS support of the
syslog transport, but given the existence of MOM and it's apparent support of
syslog, it seems inevitable that the discussion (at least with my employer) will
eventually lead down the path of MOM's abilities as a heterogeneous event
analysis (i.e. SEM) tool.

thx,
-pat.

> It may be that finally, thanks to compliance regulations etc., there
> are enough large scale organizations worrying about log collection and
> archiving that this might work. There's clearly never been enough
> momentum to get the ball rolling in the past, or we wouldn't be having
> this conversation in *sigh* 2008...
>
> cheers -- tbird
>
>
> _______________________________________________
> LogAnalysis mailing list
> LogAnalysis (at) loganalysis (dot) org [email concealed]
> http://www.loganalysis.org/mailman/listinfo/loganalysis
>
_______________________________________________
LogAnalysis mailing list
LogAnalysis (at) loganalysis (dot) org [email concealed]
http://www.loganalysis.org/mailman/listinfo/loganalysis

[ reply ]
Re: [logs] Eventlog to syslog Mar 03 2008 08:47PM
David Corlette (DCorlette novell com) (1 replies)
Re: [logs] Eventlog to syslog Mar 03 2008 09:20PM
Patrick Hull (nethead69 gmail com)
Re: [logs] Eventlog to syslog Mar 03 2008 07:58PM
Mark Bagley (mbagley splunk com)
Re: [logs] Eventlog to syslog Feb 29 2008 11:56PM
David Corlette (DCorlette novell com)
Re: [logs] Eventlog to syslog Feb 29 2008 11:46PM
Andrew Hay (andrewsmhay gmail com) (2 replies)
Re: [logs] Eventlog to syslog Mar 01 2008 02:31AM
A Ananth (ananth802 yahoo com) (1 replies)
Re: [logs] Eventlog to syslog Mar 01 2008 02:55AM
Andrew Hay (andrewsmhay gmail com) (2 replies)
Re: [logs] Eventlog to syslog Mar 02 2008 08:34PM
Rodney Thayer (rodney canola-jones com)
Re: [logs] Eventlog to syslog Mar 01 2008 03:05AM
A Ananth (ananth802 yahoo com)
Re: [logs] Eventlog to syslog Mar 01 2008 02:17AM
Rodney Thayer (rodney canola-jones com)


 

Privacy Statement
Copyright 2010, SecurityFocus