How many Event Logs/Syslogs can OSSEC process per second? Thanks, Solomon Joshua
> Date: Tue, 25 Jan 2011 09:28:51 -0500 > Subject: Re: [ossec-list] Queries regarding OSSEC Syslog Collector > From: [email protected] > To: [email protected] > > Hi Solomon, > > On Tue, Jan 25, 2011 at 6:31 AM, Solomon Joshua <[email protected]> > wrote: > > Thanks for the info. It was helpful. > > > > Can the following be configured in OSSEC? > > > > · Maintain 30 days worth of data on hand > > > > · Past 30 days the data should be compressed and archived for 30 > > days > > > > · After 60 days the data should be deleted > > > > OSSEC maintains all of the data, it doesn't really delete anything. > But you could setup some cronjobs or something to delete old data. > > > Alerting based on requirements: > > > > · Actual Alert based on specific patterns, key words > > > > This is how OSSEC works. > > > · Actual Alert delivered via email, syslog, SMNP > > > > Email and syslog work, but there isn't anything that really does SNMP. > You might be able to setup an active response to do this though. > > > Thanks, > > Solomon Joshua > > > >> Date: Mon, 24 Jan 2011 10:52:05 -0500 > >> Subject: Re: [ossec-list] Queries regarding OSSEC Syslog Collector > >> From: [email protected] > >> To: [email protected] > >> > >> Hi Solomon, > >> > >> On Mon, Jan 24, 2011 at 9:06 AM, Solomon Joshua <[email protected]> > >> wrote: > >> > Hello, > >> > > >> > Can OSSEC aggregate and display the Syslogs from any device in one > >> > location? > >> > Can the data be collected/displayed based on IP Address, Name, Part of > >> > message, Lookup by device or by message (raw string search)? > >> > > >> > Thanks, > >> > Solomon Joshua > >> > > >> > >> Check out the ossec-reportd application. It can do some of what you're > >> looking for. > >> Also tools like Splunk might be able to help. > >
