For people who are still looking for a good open source log analysis solution, you must look at the OsHids project. A new version was released (0.3), which supports many different logs(syslog, win->syslog,..) and actions (email notification, log html..), and also includes a php interface that enables the admin to monitor the logs via web and to look for some statistcs (most common log, number of total logs analyzed, etc). . . .
Os-Hids ProjectOsHids is an Open Source software that analyzes your log files and take some actions if it founds something malicious. The OsHids can be run on "Real-time", as a daemon, or you can execute it using crontab. When OsHids finds something malicious (specified on the oshids.rules), it takes a
pre-defined action. At this version, we support: * Notify by email
* Log in html
* Log in txt
* SNMP trap (*not completed)
Since v0.3, OsHIDS comes with a database (with a few log entries) to avoid some
false-positives. To see the currently database, download the OsHids and look inside the "./db/" directory. You can also look at it here.
Other interesting thing that OsHids can do, is to help you visualize any break attempt on your Firewall Policy. If you use IpTables, or any other kind of firewall that support syslog, Os-Hids can be helpful for you.
Read this full article at ossec.net
Only registered users can write comments.
Please login or register. Powered by AkoComment! |
