Re: log analyser

[giuseppe.fuggiano () gmail com]

2009/5/29  <sec () nd-f com>:
> Hi,
>
> can someone of you recommend a good enterprise log analyser solution? i have to collect, corrolate and analyse about 
> 1200 windows machines and 200 linux boxes. i want to do this in real-time, trigger actions (like email notification), 
> make sense out of e.g. ten failed login attempts following the one successful etc.

I am currently deploying this nice appliance:

http://www.balabit.com/network-security/syslog-ng/log-server-appliance/

which also encrypt and signs logs, very good support, but you could want to configure a software by yourself. So,

http://www.splunk.com/
http://eiqnetworks.com/products/SecureVue/Data_Collection.shtml
http://www.gfi.com/eventsmanager (very good but no encryption)

Cheers,
--
Giuseppe

Attachment: signature.asc
Description: OpenPGP digital signature