Re: Log Management

["Wier, Timothy A." <tim.wier () CUCHICAGO EDU>]

We have the following setup.

Windows Snare Agent --> Kiwi Syslog --> Sawmill Enterprise.
Linux (syslogd) --> Kiwi Syslog --> Sawmill

We use Kiwi to rotate file, archive to zip, and delete from zip after configurable time lengths based on the service. 
We load key data into Sawmill databases and keep it there from 30-90 days depending on the data and size.

Took a little time to get everything glued together but works fairly well now.


Tim Wier
Network Manager
Concordia University
tim.wier () cuchicago edu
708-209-3565




-----Original Message-----
From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Hammond, 
Stanley
Sent: Friday, March 05, 2010 9:11 AM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] Log Management

I am looking to see what other institutions are using to manage their
event/system log files.

Currently I have Snare installed on our Windows servers and sending the
events to a syslog server.  That server originally had Prelude IDS
installed and I was using Prewikka to view the logs as needed.  The
problem with Prelude IDS/Prewikka is that accessing the database is
painfully slow unless you purchase the database module for fast access.
The other option I tested was Splunk which I liked, but because it
access Windows systems using WMI it looked like the some of the Windows
virtual machines took a performance hit (according to our Technical
Director).  Right now, I query the logs on the syslog server using
customized Perl scripts whenever an information request is made.  We are
making some changes to our environment and would like to get something
setup that is a little better than using Perl scripts on the CLI.

Stanley M. Hammond
Information Security Specialist
Cape Cod Community College
Email: shammond () capecod edu