Re: events

[Jason LeBlanc <jml () packetpimp org>]

+1 for SEC, minimal hit on the cpu like most parsing tools, the regexp 
can be painful but it is fairly extensible.  Once you get used to it 
you'll love it.

On 10/04/2011 05:58 AM, Ben Roeder wrote:
> Hi Mike,
> We have used octopussy ( http://www.8pussy.org/dokuwiki/doku.php?id=home  yes it is work safe :-) ) with ok results.
> Have used sec ( simple event correlator http://simple-evcorr.sourceforge.net/ ) to some success in simple cases.
>
> Currently having another look at this myself and the following look interesting, but have not deployed them yet
> http://logstash.net/
> http://graylog2.org/about
>
> Ben
> On 30 Sep 2011, at 14:50, harbor235 wrote:
>
> > What is everyone using to collect, alert, and analyze syslog data?
> > I am looking for something that can generate reports as well as support
> > multiple vendors. We have done some home grown stuff in the past but
> > would be interested in something  that incorprates all the best features.
> >
> > Soalrwinds, splunk, fwanalog, and others come to mind, any other good ones
> > out there?
> >
> >
> > Mike