Syslog parsing

["Penn, Blake" <pennb () UWW EDU>]

We are in the process of engineering more robust and centralized logging to
central syslog servers.  Problem is, once you have gigs and gigs of data,
how do you parse it effectively and efficiently?

We've looked at a lot of the common open-source parsers out there and
haven't been too impressed.  Anyone know of a good syslog (or syslog-ng)
parser (free or commercial), or developed one in-house?

The features that we care most about are:

*       Robust slicing of information across different categories (machine
name, IP, event ID, etc.)
*       Correlation capabilities
*       Easy of use (preferably a web GUI, etc. for use by the lowest common
denominator)
*       Low FTE requirements!!!

Thanks in advance.


____________________________________________
Blake Penn, CISSP
Information Security Officer
University of Wisconsin-Whitewater
(p) 262-472-5513 (f) 262-472-1285
pennb () uww edu | http://www.uww.edu/security/

Attachment: smime.p7s
Description: