Re: Syslog parsing

[Christopher Arnold <christopher.arnold () TUFTS EDU>]

syslog-ng and swatch for message collection and parsing.

A correlated "event" can mean different things in different contexts.
For frameworks to get you building  toward event correlation you could
look at OSSIM (http://www.ossim.net/) and Prelude
(http://www.prelude-ids.org/).

I personally think that the Prelude effort is on the right track and
would be happy to discuss off-line, if you care to.

Best of luck,

-CMA

Penn, Blake wrote:
> We are in the process of engineering more robust and centralized logging to
> central syslog servers.  Problem is, once you have gigs and gigs of data,
> how do you parse it effectively and efficiently?
>
> We've looked at a lot of the common open-source parsers out there and
> haven't been too impressed.  Anyone know of a good syslog (or syslog-ng)
> parser (free or commercial), or developed one in-house?
>
> The features that we care most about are:
>
> *       Robust slicing of information across different categories (machine
> name, IP, event ID, etc.)
> *       Correlation capabilities
> *       Easy of use (preferably a web GUI, etc. for use by the lowest common
> denominator)
> *       Low FTE requirements!!!
>
> Thanks in advance.
>
>
> ____________________________________________
> Blake Penn, CISSP
> Information Security Officer
> University of Wisconsin-Whitewater
> (p) 262-472-5513 (f) 262-472-1285
> pennb () uww edu | http://www.uww.edu/security/