From owner-freebsd-security@FreeBSD.ORG Thu Jan 13 18:32:42 2005 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id AF8E116A4CE for ; Thu, 13 Jan 2005 18:32:42 +0000 (GMT) Received: from omoikane.mb.skyweb.ca (64-42-246-34.mb.skyweb.ca [64.42.246.34]) by mx1.FreeBSD.org (Postfix) with ESMTP id 6EC7943D1F for ; Thu, 13 Jan 2005 18:32:42 +0000 (GMT) (envelope-from mark@skyweb.ca) Received: by omoikane.mb.skyweb.ca (Postfix, from userid 1001) id CE85561D9D; Thu, 13 Jan 2005 12:32:44 -0600 (CST) From: Mark Johnston To: freebsd-security@freebsd.org Date: Thu, 13 Jan 2005 12:32:44 -0600 User-Agent: KMail/1.6.1 MIME-Version: 1.0 Content-Disposition: inline Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Message-Id: <200501131232.44441.mjohnston@skyweb.ca> Subject: Aggregating logs from numerous FreeBSD machines X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Jan 2005 18:32:42 -0000 Hi folks, My stack of trusty FreeBSD servers always seems to be growing, and it's getting to the point where the daily and security output mail is too much to make good use of. I'm looking for suggestions for log monitoring and aggregation tools, especially from a monitoring-for-security perspective. If I had to imagine an ideal system, it would be a central server that securely collects syslog messages from all my servers, indexes them by server and severity, and gives a reasonable management interface. Given expressions based on facility, severity, log message, and the like, it could throw away useless messages, or page me for critical ones. This would tie into AIDE/Samhain/Tripwire (haven't picked one yet) and maybe even different flavors of IDS. It could even warn me when processes run away with the CPU or RAM, or disks get too full. I've found a variety of things that almost do this. Nagios is good at paging for service failures, disk full warnings, and that sort of thing, but it doesn't seem well-suited for aggregating log messages. The Prelude IDS seems to have some kind of console, as does Samhain, but I want to try to avoid having different interfaces for each service type. I realize this is something that could be had using IPSec-protected remote logging with some greps and interface stuff bolted on, but if there's a ready-made tool, it'd save me a fair bit of implementation time. What kind of things are other security-minded admins using to stay on top of all the logs? Thanks, Mark