RE: [Full-disclosure] Windows 2003 Logging/Log Analysis Tool

["Fielder, Kevin \(GE Consumer Finance\)" <Kevin.Fielder@xxxxxx>]

Another good option that's also quite cheap is event reporter clients and kiwi 
syslog server have used this previously for centralising windows event logs.

These can also filter at the client and server side so you see only relevant 
information. 

K

-----Original Message-----
From: full-disclosure-bounces@xxxxxxxxxxxxxxxxx 
[mailto:full-disclosure-bounces@xxxxxxxxxxxxxxxxx] On Behalf Of MadHat
Sent: 17 November 2005 16:46
To: full-disclosure@xxxxxxxxxxxxxxxxx
Subject: Re: [Full-disclosure] Windows 2003 Logging/Log Analysis Tool

On Nov 17, 2005, at 10:34 AM, John Goh wrote:
> Hi all
>
> Hope to get suggestions on log analysis softwares.
>
> I'm looking for recommendation on what are the better log analysis 
> softwares around that're capable of generating good logs for;
>
> IIS 6.0
> NetApp NetCache 5.x
> Microsoft ISA RRAS
> Are there also Log Agents available for System so that all the logs 
> are contributed to a Centralized Log Server?

"Log analysis" is vague, there are several aspects to log analysis, but as far 
as ways of getting the data to a central server and watching for specific 
events, I like snare and sec.

Snare:
http://www.intersectalliance.com/projects/index.html

SEC (simple event correlator):
http://kodu.neti.ee/~risto/sec/

--
MadHat (at) Unspecific.com, C²ISSP
E786 7B30 7534 DCC2 94D5  91DE E922 0B21 9DDC 3E98 gpg --keyserver 
wwwkeys.us.pgp.net --recv-keys 9DDC3E98

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/