RE: Logging

["Petter Bruland" <pbruland () fcglv com>]

Splunk! (Google Splunk)

They have a free version for up to 500 MB a day in logs, which actually
for a small/medium biz is ok.
And the pay version isn't too badly priced either.

Very easy to setup, and supports many different ways to alert and filter
logs.
If you have Windows servers, then you can use Snare clients to send the
event logs as syslog messages to it. Works great!

Kiwi as also pretty nice.


-Petter



-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com]
On Behalf Of Lee Hilt
Sent: Friday, January 18, 2008 11:19 AM
To: 'Krzyston, Randy'; security-basics () securityfocus com
Cc: listbounce () securityfocus com
Subject: RE: Logging

If you are simply looking for a storage solution, (logs in, emails on
threshold of error rates, etc) Kiwi would be the way to go. 

If you are looking for a more granular look, along with searchable
questions like "Show me accounts with a high incidence of password
failures" and other questions, your solution might best be serviced by

http://manageengine.adventnet.com/products/eventlog/index.html

Pricing is kinda high, but it is a pretty good product.
 

-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com]
On Behalf Of Krzyston, Randy
Sent: 2008-01-18 1:19
To: security-basics () securityfocus com
Cc: listbounce () securityfocus com
Subject: Logging

We are looking to implement a syslog server.  It needs to not only be
capable of storing logs ,but also detailed reporting for things such as
SOX.
I've looked at LogLogic's products.  I also heard about Kiwi, but have
not experience with it.

Any comments?


Randy