Security Log Analyser Tool?

andyb28 · 18th August 2008

Does anyone know of a good tool that monitors Windows and Linux log files and reports back? (mainly for attempted logins)

I guess I could probably code something, but surely something like this already exists.

TIA

BurtyB · 18th August 2008

logwatch on Linux if you want to stare at screen after screen of email

ChrisB.

freethought · 18th August 2008

If you're looking for something to track failed SSH logins etc. then we use LFD (part of the CSF iptables toolkit) on Linux which can be configured to automatically drop trafic from the source IP. Quite flexible too, you can drop just SSH traffic and set the entries to age out etc.
Pretty sure it can handle FTP, POP3 etc. i you teach it what a failed login looks like in the logs.
Used to use BFD which does pretty much the same thing but isn't maintained any more and lacks some of the options.

TDMWeb · 18th August 2008

CSF from ConfigServer Services is very good and does exactly what you want for Linux. Not come across anything similar for Windows.

dch · 19th August 2008

I think Welcome to the Home of OSSEC will do what you want, it is open source and works with most common OSs

Cheers,
Sean

VooServers · 25th August 2008

Microsoft have one but I can't remember the name of it right now. It's pretty cool though as you can wait for a specific event and then make it automatically do the crash on ctrl + scroll lck so it dump's the memory. It's more for troubleshooting specific events but you could also set it up to e-mail when a login event is found. If you search Microsoft you will probably find it anyway but I will check my e-mails when I get a chance.

andyb28 · 26th August 2008

Is it Operations Manager Matt?

VooServers · 26th August 2008

Quote:

Originally Posted by andyb28

Is it Operations Manager Matt?

Nope it's a free tool but I believe you have to go through Microsoft Support to get it and then they will e-mail it to you. I have got it on a server somewhere so if I find it I will let you know as the Microsoft link they sent me has expired now.