RE: Windows 2003 Logging/Log Analysis Tool

["Fielder, Kevin (GE Consumer Finance)" <Kevin.Fielder () ge com>]

Another good option that's also quite cheap is event reporter clients and kiwi syslog server have used this previously 
for centralising windows event logs.

These can also filter at the client and server side so you see only relevant information. 

K

-----Original Message-----
From: full-disclosure-bounces () lists grok org uk [mailto:full-disclosure-bounces () lists grok org uk] On Behalf Of 
MadHat
Sent: 17 November 2005 16:46
To: full-disclosure () lists grok org uk
Subject: Re: [Full-disclosure] Windows 2003 Logging/Log Analysis Tool

On Nov 17, 2005, at 10:34 AM, John Goh wrote:
> Hi all
>
> Hope to get suggestions on log analysis softwares.
>
> I'm looking for recommendation on what are the better log analysis 
> softwares around that're capable of generating good logs for;
>
> IIS 6.0
> NetApp NetCache 5.x
> Microsoft ISA RRAS
> Are there also Log Agents available for System so that all the logs 
> are contributed to a Centralized Log Server?

"Log analysis" is vague, there are several aspects to log analysis, but as far as ways of getting the data to a central 
server and watching for specific events, I like snare and sec.

Snare:
http://www.intersectalliance.com/projects/index.html

SEC (simple event correlator):
http://kodu.neti.ee/~risto/sec/

--
MadHat (at) Unspecific.com, C²ISSP
E786 7B30 7534 DCC2 94D5  91DE E922 0B21 9DDC 3E98 gpg --keyserver wwwkeys.us.pgp.net --recv-keys 9DDC3E98

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/