Re: Syslog parsing

[Steve Lovaas <steven.lovaas () COLOSTATE EDU>]

Take a look at SPLUNK as well:

http://www.splunk.com/

Steve Lovaas

Justin Dover wrote:
> [ http://www.kiwisyslog.com/index.php ]Kiwi syslog is great.  The prof. version has tons of options, easy to use and 
> not too $$$.
>
> Justin Dover
> Harpeth Hall School
> 615-346-0082
>
> The EDUCAUSE Security Discussion Group Listserv <SECURITY () LISTSERV EDUCAUSE EDU> on Tuesday, April 25, 2006 at 
> 10:21 AM -0600 wrote:
> > We are in the process of engineering more robust and centralized logging to
> > central syslog servers.  Problem is, once you have gigs and gigs of data,
> > how do you parse it effectively and efficiently?
> >
> > We've looked at a lot of the common open-source parsers out there and
> > haven't been too impressed.  Anyone know of a good syslog (or syslog-ng)
> > parser (free or commercial), or developed one in-house?
> >
> > The features that we care most about are:
> >
> > *    Robust slicing of information across different categories (machine
> > name, IP, event ID, etc.)
> > *    Correlation capabilities
> > *    Easy of use (preferably a web GUI, etc. for use by the lowest common
> > denominator)
> > *    Low FTE requirements!!!
> >
> > Thanks in advance.