I use NTSyslog (http://ntsyslog.sourceforge.net) configured to forward all events to a Linux syslog server. On that server I then run swatch to filter away all uninteresting things. Works quite well.

Regards, Lars

-----Original Message-----
From: listbounce (at) securityfocus (dot) com [email concealed] [mailto:listbounce (at) securityfocus (dot) com [email concealed]] On
Behalf Of Ron Johnson - Adhost
Sent: Tuesday, January 29, 2008 12:51 PM
To: focus-ms (at) securityfocus (dot) com [email concealed]
Subject: Centralizing Event Viewer Logs

Hello List:

I was looking into options that will allow us to centralize Event Viewer
Logs in an Active Directory domain - can anyone recommend any software
for this? It would be great if we could find a piece of software that
does just this - not a full blown enterprise security solution that
cost$ and does many other things that we wouldn't use it for
necessarily.

Thanks!

[ reply ]