Amazing! Now I just have to find a good front end for log mining and relationship tracking similar to what the costly stuff does.
I would rather just invest in making ossec more like arcsight etc, not the other way around :) On Mon, Jan 10, 2011 at 5:32 PM, dan (ddp) <[email protected]> wrote: > Hi Andy, > > On Mon, Jan 10, 2011 at 5:18 PM, NetSyphon <[email protected]> wrote: > > Hello List, > > Does OSSEC do any sort of log replay on either windows or *nix, so that > if > > an agent is stopped and started that it will "replay" to catch up? I'm > > trying to prove that OSSEC is at least a better option than something > like > > syslogd/SNARE/logparser for log centralization (and in many cases better > > than overpriced and bloated solutions from vendors like arcsight, if > there > > was only a more robust front end!). > > > > TIA, > > Andy > > > > > > The agents keep track of where in the logfiles they stop. So if the > ossec processes were stopped and started again a while later they > should pick up where they left off. >
