Hi Solomon, On Thu, Jan 27, 2011 at 7:59 AM, Solomon Joshua <[email protected]> wrote: > How many Event Logs/Syslogs can OSSEC process per second? > > Thanks, > Solomon Joshua >
I haven't done any testing, but I think that would depend on your hardware. >> Date: Tue, 25 Jan 2011 09:28:51 -0500 >> Subject: Re: [ossec-list] Queries regarding OSSEC Syslog Collector >> From: [email protected] >> To: [email protected] >> >> Hi Solomon, >> >> On Tue, Jan 25, 2011 at 6:31 AM, Solomon Joshua <[email protected]> >> wrote: >> > Thanks for the info. It was helpful. >> > >> > Can the following be configured in OSSEC? >> > >> > · Maintain 30 days worth of data on hand >> > >> > · Past 30 days the data should be compressed and archived for 30 >> > days >> > >> > · After 60 days the data should be deleted >> > >> >> OSSEC maintains all of the data, it doesn't really delete anything. >> But you could setup some cronjobs or something to delete old data. >> >> > Alerting based on requirements: >> > >> > · Actual Alert based on specific patterns, key words >> > >> >> This is how OSSEC works. >> >> > · Actual Alert delivered via email, syslog, SMNP >> > >> >> Email and syslog work, but there isn't anything that really does SNMP. >> You might be able to setup an active response to do this though. >> >> > Thanks, >> > Solomon Joshua >> > >> >> Date: Mon, 24 Jan 2011 10:52:05 -0500 >> >> Subject: Re: [ossec-list] Queries regarding OSSEC Syslog Collector >> >> From: [email protected] >> >> To: [email protected] >> >> >> >> Hi Solomon, >> >> >> >> On Mon, Jan 24, 2011 at 9:06 AM, Solomon Joshua >> >> <[email protected]> >> >> wrote: >> >> > Hello, >> >> > >> >> > Can OSSEC aggregate and display the Syslogs from any device in one >> >> > location? >> >> > Can the data be collected/displayed based on IP Address, Name, Part >> >> > of >> >> > message, Lookup by device or by message (raw string search)? >> >> > >> >> > Thanks, >> >> > Solomon Joshua >> >> > >> >> >> >> Check out the ossec-reportd application. It can do some of what you're >> >> looking for. >> >> Also tools like Splunk might be able to help. >> > >
