Thread: Security Log Analyser Tool?

Does anyone know of a good tool that monitors Windows and Linux log files and reports back? (mainly for attempted logins)

I guess I could probably code something, but surely something like this already exists.

TIA

logwatch on Linux if you want to stare at screen after screen of email

ChrisB.

If you're looking for something to track failed SSH logins etc. then we use LFD (part of the CSF iptables toolkit) on Linux which can be configured to automatically drop trafic from the source IP. Quite flexible too, you can drop just SSH traffic and set the entries to age out etc.
Pretty sure it can handle FTP, POP3 etc. i you teach it what a failed login looks like in the logs.
Used to use BFD which does pretty much the same thing but isn't maintained any more and lacks some of the options.

CSF from ConfigServer Services is very good and does exactly what you want for Linux. Not come across anything similar for Windows.

I think Welcome to the Home of OSSEC will do what you want, it is open source and works with most common OSs

Cheers,
Sean

Microsoft have one but I can't remember the name of it right now. It's pretty cool though as you can wait for a specific event and then make it automatically do the crash on ctrl + scroll lck so it dump's the memory. It's more for troubleshooting specific events but you could also set it up to e-mail when a login event is found. If you search Microsoft you will probably find it anyway but I will check my e-mails when I get a chance.

Is it Operations Manager Matt?

Originally Posted by andyb28

Is it Operations Manager Matt?

Nope it's a free tool but I believe you have to go through Microsoft Support to get it and then they will e-mail it to you. I have got it on a server somewhere so if I find it I will let you know as the Microsoft link they sent me has expired now.