Re: [PLUG] Syslog?

[brent timothy saner <brent.saner@gmail.com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 03/17/2014 11:18 AM, jeff wrote:
> I had asked a while back about a decent syslog system.  Was
> wondering if anything had changed.
> 
> My main focus is correlation.  Syslog outputs to that lovely
> advancing wall of text.  What alternative is there to grep(ing) and
> regex(ing), possibly with a GUI?  I'm looking to log-monitor a load
> of servers that run The Other OS.  Would prefer to stay
> linux-based.
> 
> We're non-profit and can't afford what we'd like soon. We tried 
> Alienvault but that was an unqualified mess.
> 
> 
> Yours in GUI....
> 
> -jeff
> 

a bit of clarification might be necessary here;

1.) *what* logs are you concerned with? web traffic, system events
(e.g. dmesg), security escalations, firewalls, etc.? once you know
that, it'll be easier to recommend a parser.
2.) where exactly are you logging from; what source? i can't quite
tell as it's a bit ambiguous. what do you mean by "The Other OS"- do
you mean you're trying to sent logs FROM windows TO a linux machine
for parsing/processing? nxlog[0] might be your best bet, but you'll
need something for actually parsing out those logs- i think
GrayLog2[1] works quite nicely for that, it seems.

[0] http://nxlog.org/
[1] http://www.graylog2.org/#home
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQIcBAEBAgAGBQJTJxdxAAoJEIwATC+TSB9rin4P/1yP2GEYz8wZ0di/nnjTiKa0
WzGgpD+IteOFRaaQuJ0heLtfZC7pzCUtq9NlJXgMjKvFg2o5Sqfdb7Qt23QkE1Sv
F+u15ilVrGTcrOtWHAn/jdhRAhGWIs29BVEWSSUqUrmVh+yQKKehH49AUmHuUIl5
RkWSisaOkG22nKkOJPhXqhS6UXpP3U3e+aMzK63FYYrXF87AeHCoGihMHQNn88dT
rZxt6hE4RRPt5BByE/Nbq/WXvqXrE/+YlwrSgvECBqYsZ4cmCqRERozaoiC/Pkvc
GNFMSVDJh3e16BbGYVhT46bM1vEaKKMqC5AoiwNsCKhk+BnG6zu1WdyY2Zap3yin
oo6CEgutEZjy5cK8JB8GqtesvJ/mMg/KYln3rG2RIwa0IoB2wQKuxXEpNj7qg7nv
7n5viOAVPK8SjBnYJF8QLz1SSCDcHJEP9AgvZ8caPVMXEs8ggSU6Pl6RkdBwRxaC
8wQIPWzlQW8IA8ztORtccS3QyMJsladH+cEpqInq2/qF3ErcI/LmN/Gig8/NU3vL
KMR3ke9GPb2/lBPo7lztCerE+yIQE3pCDnRbFDG5kF/9V9YvnncSQwdKtDmVHC+e
uGcZdGHiNn3CPFyVvz5Oyi2sWZfxmw2y7rWqJYewtUhOVq9lZyIhSy8bSBQdWOD8
6qjXGNKUXCEE/eGWtPTY
=/Pzy
-----END PGP SIGNATURE-----
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug