Re: Event Log Monitor Program

[scott <redhowlingwolves () bellsouth net>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Ossec is actually a very good HIDS logging-event notifier.

You can change any log notifications using simple XML rulesets.It is
really easy to configure ( server=agent ).
All logs you want can written easily (no API's).Just simple XML.They
can be sent to any address you specify.

Sometimes there is a problem with simple SMTP because the OSSEC
drivers use their own mailer.This can be a problem if not configured
correctly.

Surely, you can configure your own POP and SMTP.

Excellent for our needs.

Cheers,  Redwolves rule


Kurt Buff wrote:
> On each server, I'd place either the Snare client
> (http://www.intersectalliance.com - it's open source) or evtsys
> (google for it, I don't have the URL handy) - these format the
> events and send them out via syslog. To collect the logs, it
> depends on what you want to do, but the Kiwi syslog server is free
> or damn cheap (the free version won't log to ODBC or do a couple of
> other useful things, the pay version will, and last I looked, the
> pay version was around US$100.00) and really good, or set up a *nix
> box (I like FreeBSD) .
>
> As a possible alternative, OSSEC might be worth your while.
> http://www.ossec.org - it's a HIDS package that seems very
> interesting, though I haven't had time to play with it yet.
>
> Kurt
>
> On 9/20/07, Adam Savage <Adam_Savage () skillsoft com> wrote:
> > I'm looking for a good event log program that can consolidate all
> > my event logs from my servers into one location. Then I can
> > report on them and such. We purchased GFI Security Event Log
> > Monitor but we find the program cumbersome at best and doesn't
> > give you any insight on some of the event messages that are
> > produced. I'd like to know if there is a freeware/opensource
> > solution. I know GFI has recently come out with the Successor to
> > SELM called EventsManager but we'd like to look into some other
> > products that are out there first.
> >
> > Any replies would be greatly appreciated.
> >
> > Thank you,
> >
> > Adam

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFG82OYsrt057ENXO4RAnzbAJ9R3sw43twTgARVTSfb8bEJwFYfYACgiOMD
dou1UBoK6Sloe+VESURbtpE=
=mqh1
-----END PGP SIGNATURE-----