Re: log monitoring/analysis/correlation systems

[Emilio Casbas <ecasbas () unav es>]

sami seclist escribió:
> Hi list,
> a client of our is looking for a log monitoring solution for it's
> network security infrastructure.
> Logs are to be collected from routers, firewalls, IDS and antivirus.
> The only product I found to be applicable in this situation is cisco's
> Security Monitoring Analysis and Response Systems (In fact it does
> much than what is needed !).
> Other products I found
> exaprotect (seems to be the best option)
> hp openview and IBM tivoli manager (I think they are too heavy for
> this company and also very expensive)
>
> does anybody know of other log monitoring systems, and what do you
> think of the above ?
> Syslog is not an option as log files have heterogeneous formats and is
> somewhat tricky to obtain a practical usage
>
> regards
> sami.
You could use nagios (http://www.nagios.org/) with the appropiate 
check_log script,
and/or monitoring statistics with mrtg (http://oss.oetiker.ch/mrtg/)

Regards.
Emilio C.

--
Emilio Casbas
University of Navarra



---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence 
in Information Security. Our program offers unparalleled Infosec management 
education and the case study affords you unmatched consulting experience. 
Using interactive e-Learning technology, you can earn this esteemed degree, 
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------