From owner-freebsd-security@FreeBSD.ORG Thu Jan 13 18:54:33 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B8A8316A4CE for ; Thu, 13 Jan 2005 18:54:33 +0000 (GMT) Received: from otter3.centtech.com (moat3.centtech.com [207.200.51.50]) by mx1.FreeBSD.org (Postfix) with ESMTP id EFE4743D45 for ; Thu, 13 Jan 2005 18:54:32 +0000 (GMT) (envelope-from anderson@centtech.com) Received: from [10.177.171.220] (neutrino.centtech.com [10.177.171.220]) by otter3.centtech.com (8.12.3/8.12.3) with ESMTP id j0DIsVOJ025205; Thu, 13 Jan 2005 12:54:31 -0600 (CST) (envelope-from anderson@centtech.com) Message-ID: <41E6C3DE.3080709@centtech.com> Date: Thu, 13 Jan 2005 12:54:22 -0600 From: Eric Anderson User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.7.3) Gecko/20041110 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Mark Johnston References: <200501131232.44441.mjohnston@skyweb.ca> In-Reply-To: <200501131232.44441.mjohnston@skyweb.ca> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit cc: freebsd-security@freebsd.org Subject: Re: Aggregating logs from numerous FreeBSD machines X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Jan 2005 18:54:33 -0000 Mark Johnston wrote: > Hi folks, > > My stack of trusty FreeBSD servers always seems to be growing, and it's > getting to the point where the daily and security output mail is too much to > make good use of. I'm looking for suggestions for log monitoring and > aggregation tools, especially from a monitoring-for-security perspective. A project started about a year ago to do just this. Did in the archives of the freebsd mailing lists for it.. Eric -- ------------------------------------------------------------------------ Eric Anderson Sr. Systems Administrator Centaur Technology I have seen the future and it is just like the present, only longer. ------------------------------------------------------------------------