Educause Security Discussion mailing list archives
Re: Syslog parsing
From: Christopher Arnold <christopher.arnold () TUFTS EDU>
Date: Tue, 25 Apr 2006 15:08:04 -0400
syslog-ng and swatch for message collection and parsing. A correlated "event" can mean different things in different contexts. For frameworks to get you building toward event correlation you could look at OSSIM (http://www.ossim.net/) and Prelude (http://www.prelude-ids.org/). I personally think that the Prelude effort is on the right track and would be happy to discuss off-line, if you care to. Best of luck, -CMA Penn, Blake wrote:
We are in the process of engineering more robust and centralized logging to central syslog servers. Problem is, once you have gigs and gigs of data, how do you parse it effectively and efficiently? We've looked at a lot of the common open-source parsers out there and haven't been too impressed. Anyone know of a good syslog (or syslog-ng) parser (free or commercial), or developed one in-house? The features that we care most about are: * Robust slicing of information across different categories (machine name, IP, event ID, etc.) * Correlation capabilities * Easy of use (preferably a web GUI, etc. for use by the lowest common denominator) * Low FTE requirements!!! Thanks in advance. ____________________________________________ Blake Penn, CISSP Information Security Officer University of Wisconsin-Whitewater (p) 262-472-5513 (f) 262-472-1285 pennb () uww edu | http://www.uww.edu/security/
Current thread:
- Syslog parsing Penn, Blake (Apr 25)
- <Possible follow-ups>
- Re: Syslog parsing Justin Dover (Apr 25)
- Re: Syslog parsing Steve Lovaas (Apr 25)
- Re: Syslog parsing Jenkins, Matthew (Apr 25)
- Re: Syslog parsing Keith Schoenefeld (Apr 25)
- Re: Syslog parsing Justin Dover (Apr 25)
- Re: Syslog parsing Christopher Arnold (Apr 25)
- Re: Syslog parsing Greg Vickers (Apr 25)