Re: Log Management

[Joe Vieira <jvieira () CLARKU EDU>]

We are using snare on windows.  Piping it all back to rsyslog with flat
files AND database logging, database logging is trimmed aggressively and
big load things like email logs don't goto it.

Works well
Joe Vieira
Manager, Systems Administration
Clark University - ITS

Hammond, Stanley wrote:
> I am looking to see what other institutions are using to manage their
> event/system log files.
>
> Currently I have Snare installed on our Windows servers and sending the
> events to a syslog server.  That server originally had Prelude IDS
> installed and I was using Prewikka to view the logs as needed.  The
> problem with Prelude IDS/Prewikka is that accessing the database is
> painfully slow unless you purchase the database module for fast access.
> The other option I tested was Splunk which I liked, but because it
> access Windows systems using WMI it looked like the some of the Windows
> virtual machines took a performance hit (according to our Technical
> Director).  Right now, I query the logs on the syslog server using
> customized Perl scripts whenever an information request is made.  We are
> making some changes to our environment and would like to get something
> setup that is a little better than using Perl scripts on the CLI.
>
> Stanley M. Hammond
> Information Security Specialist
> Cape Cod Community College
> Email: shammond () capecod edu