Windows Event Log Analysis / Correlation

Hello All,

I am working in an environment where we have a mix of systems Windows Vista, 7 and XP and on Servers all Server 2008 R2. I am looking for a tool (free or opensource) which will help me do event log analysis and correlation for all the server machines. Currently, I am not looking for any centralized solution just a stand alone will be fine as well. Does any one has any experience or played with this kind of thing before.

Any help will be highly appreciated.


Thanks

http://sourceforge.net/projects/snare/

Thanks ua549,
i will surely give it a try.

If you like it, there are some proprietary server apps available. IIRC they run on *nix but can pull data from any snare client.

Quote:

---

Originally Posted by mmkhan

Servers all Server 2008 R2.

---

Quote:

---

Originally Posted by mmkhan

I am looking for a tool (free or opensource) which will help me do event log analysis and correlation for all the server machines.

---

don't MS have a built-in perfmon / sysmon all ready to be set up and run, it is quite a nice little package too, lots of tweaks to be done
and all from start - run - perfmon

Quote:

---

Originally Posted by mmkhan

Currently, I am not looking for any centralized solution just a stand alone will be fine as well.

---

but as you are in a domain setting, why go along the stand alone route,

The performance monitor in Windows does not look at event logs which are used for auditing, not performance.

If the OP is interested in performance monitoring, I recommend a free tool called MRTG.
It can graph data from Windows performance counters as well as mib and oid data.

Hello Guys,

Thanks for your insightful replies, this will surely help me to explore more into Windows monitoring,

UA549: I installed snare agent on my windows system (Windows 7 ultimate) and I am accessing eventlogs through web browser. The problem which I faced today are that I am only show only current events for past 10 15 mins events before that are not show. It shows me the full details of each and every event. Is this possible that it shows me only the summaries, like how many times a user logged in, unsuccessful logins, successful logins etc.

Thanks

I've never used the software so I don't have an answer.
IMO what you want is in the realm of the snare server software.

ua549: cool, so you use only windows eventviewer.

I'm a retired networking consultant. Most of my clients (governments, law enforcement, large banks) used proprietary log consolidation/analysis software.

Snare is meant to be used with a central logging system, it only provides a diff of what it gathered the previous time

Here is a proprietary Snare server. It requires a small Linux box to run.