full-disclosure - Windows 2003 Logging/Log Analysis Tool

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <BD220CD07B74754BB80E807D3C6BD2461F9389D7@KINMLVEM03.e2k.ad.ge.com>
Date: Thu Nov 17 16:50:00 2005
From: Kevin.Fielder at ge.com (Fielder, Kevin (GE Consumer Finance))
Subject: Windows 2003 Logging/Log Analysis Tool

Another good option that's also quite cheap is event reporter clients and kiwi syslog server have used this previously for centralising windows event logs.

These can also filter at the client and server side so you see only relevant information. 

K

-----Original Message-----
From: full-disclosure-bounces@...ts.grok.org.uk [mailto:full-disclosure-bounces@...ts.grok.org.uk] On Behalf Of MadHat
Sent: 17 November 2005 16:46
To: full-disclosure@...ts.grok.org.uk
Subject: Re: [Full-disclosure] Windows 2003 Logging/Log Analysis Tool

On Nov 17, 2005, at 10:34 AM, John Goh wrote:
> Hi all
>
> Hope to get suggestions on log analysis softwares.
>
> I'm looking for recommendation on what are the better log analysis 
> softwares around that're capable of generating good logs for;
>
> IIS 6.0
> NetApp NetCache 5.x
> Microsoft ISA RRAS
> Are there also Log Agents available for System so that all the logs 
> are contributed to a Centralized Log Server?

"Log analysis" is vague, there are several aspects to log analysis, but as far as ways of getting the data to a central server and watching for specific events, I like snare and sec.

Snare:
http://www.intersectalliance.com/projects/index.html

SEC (simple event correlator):
http://kodu.neti.ee/~risto/sec/

--
MadHat (at) Unspecific.com, C?ISSP
E786 7B30 7534 DCC2 94D5  91DE E922 0B21 9DDC 3E98 gpg --keyserver wwwkeys.us.pgp.net --recv-keys 9DDC3E98

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/