Sending Windows events to a syslog server

The syslog server facility in linux/unix systems is an extremely good tool for gathering log files from multiple servers. Windows servers do not provide this functionality by default and therefore if you want to setup a syslog server, you need a couple of third party tools.

I've found that the Snare agent is an excellent free tool for sending event logs using the syslog protocol.

Snare homepage: http://www.intersectalliance.com/projects/Snare/

If you are sending the events to a linux system, then I have used syslog-ng as a good central syslog server because it has the ability to save the syslog entries it receives to a MySQL database.

InterSect (the makers of snare) also have a snare server which runs on Windows and is able to receive and store the events from multiple servers. Though I have never tried it, they also have a free version of their snare server.

Author: DPAK
Created: Oct 1 2005 (last modified Oct 6 2005)
Categories: Security
TechByte #45

Warning: By visiting this site and/or by using any information contained herein, you agree to the Techbytes.ca terms of use.

Comment posted by 'Anonymous' on Sep 17 2006 @ 21:51:53
Very nice site!
Comment posted by 'Anonymous' on Aug 12 2007 @ 21:02:32
hello! nice site, I like it!