On Mon, Jan 10, 2011 at 5:46 PM, NetSyphon <[email protected]> wrote: > Amazing! Now I just have to find a good front end for log mining and > relationship tracking similar to what the costly stuff does. > I would rather just invest in making ossec more like arcsight etc, not the > other way around :) >
Splunk has some nice features. > On Mon, Jan 10, 2011 at 5:32 PM, dan (ddp) <[email protected]> wrote: >> >> Hi Andy, >> >> On Mon, Jan 10, 2011 at 5:18 PM, NetSyphon <[email protected]> wrote: >> > Hello List, >> > Does OSSEC do any sort of log replay on either windows or *nix, so that >> > if >> > an agent is stopped and started that it will "replay" to catch up? I'm >> > trying to prove that OSSEC is at least a better option than something >> > like >> > syslogd/SNARE/logparser for log centralization (and in many cases better >> > than overpriced and bloated solutions from vendors like arcsight, if >> > there >> > was only a more robust front end!). >> > >> > TIA, >> > Andy >> > >> > >> >> The agents keep track of where in the logfiles they stop. So if the >> ossec processes were stopped and started again a while later they >> should pick up where they left off. > >
