Re: Log Management

[Justin Azoff <JAzoff () UAMAIL ALBANY EDU>]

On Fri, Mar 05, 2010 at 10:11:24AM -0500, Hammond, Stanley wrote:
> The other option I tested was Splunk which I liked, but because it
> access Windows systems using WMI it looked like the some of the Windows
> virtual machines took a performance hit (according to our Technical
> Director).

I have a feeling that the problem you ran into was that you had the "Windows"
app enabled which aggresively logs many things you probably don't care about,
like cpu or memory usage.  The "Unix" app does the same thing.

If disabling all of the extras in the Windows app doesn't help, or you really
don't want to run splunk on the servers, you could set it up using:

    Windows+snare -> syslog+splunk forwarder -> splunk indexer

instead of

    Windows+splunk forwarder -> splunk indexer

However, If you do that you use some of the benefits of having the forwarder
running on the box itself.


--
-- Justin Azoff
-- Network Security & Performance Analyst