<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style>
</head>
<body class='hmmessage'>
After our security team completed POC testing from multiple vendors, we are in the process of implementing LogRhythm in our environment which includes 5000+ servers (Linux, Windows and Solaris).<br><br><br>Len<br><br><hr id="stopSpelling">Date: Thu, 3 Mar 2011 15:00:53 +0100<br>From: postnalista@googlemail.com<br>To: centos@centos.org<br>Subject: Re: [CentOS] log monitoring and reporting software<br><br><br><br><div class="ecxgmail_quote">On Thu, Mar 3, 2011 at 2:46 PM, Les Mikesell <span dir="ltr"><<a href="mailto:lesmikesell@gmail.com">lesmikesell@gmail.com</a>></span> wrote:<br><blockquote class="ecxgmail_quote" style="padding-left: 1ex;">
<div><div></div><div class="h5">On 3/3/11 3:12 AM, Janez Kosmrlj wrote:<br>
> Hi folks,<br>
> In the company where i work, we are implementing a security standard. A part of<br>
> this is a log monitoring and reporting software. There are a few requirements,<br>
> that the software must fulfil:<br>
> - It must be capable of collecting logs from different devices (Linux machines,<br>
> network equipment, ...).<br>
> - it must be capable of sending alarms on security events<br>
> - it has to generate daily (weekly, monthly) reports<br>
> - it's a plus if it is easy configurable<br>
> - it has to have a good support or at least a good community if it is an<br>
> opensource product<br>
><br>
> So what are you using or at least some recommendations would be nice. An<br>
> opensource product would be nice, but it's not required.<br>
><br>
> I know i could google it, but it's difficult to decide for a product just from<br>
> online and marketing presentations. It would be nice to get some real world<br>
> experience.<br>
<br>
</div></div>OpenNMS is a good snmp monitoring framework with notification/reporting. It<br>
doesn't 'collect' logs but you can configure it to receive syslog from other<br>
machines and there are a variety of other ways you can pick up data. I'm not<br>
sure I'd call it easy to configure, but there are examples on their wiki.<br>
<a href="http://www.opennms.org" target="_blank">http://www.opennms.org</a><br>
<font color="#888888"><br>
--<br>
Les Mikesell<br>
<a href="mailto:lesmikesell@gmail.com">lesmikesell@gmail.com</a><br>
</font><div><div></div><div class="h5">_______________________________________________<br>
CentOS mailing list<br>
<a href="mailto:CentOS@centos.org">CentOS@centos.org</a><br>
<a href="http://lists.centos.org/mailman/listinfo/centos" target="_blank">http://lists.centos.org/mailman/listinfo/centos</a><br>
</div></div></blockquote></div><br>It has to collect logs from syslog (or similar service ), because one requirement for certification is "log history from all devices in one place". And since we are talking about 1500 devices it should be easy to configure and maintain.<br>
<br>_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos </body>
</html>