Enterprise Log management systems

[phishphreek]

We've been using Cisco MARS for a little over a year now.
http://www.cisco.com/en/US/products/ps6241/index.html

It's great compared to what we were using before... We were just using homebrew scripts to go out and look for certain events and to dump those in a report. Obviously, the firewalls and IDS and other network devices all had other logs... but it was not all in one place. We were using a whole mix and it was a real pain to figure out exactly what was going on. We don't have dedicated people to sit around and just watch logs... We'd be lucky if we could find 1-2 hours in the week to pour through logs. I was using Bindview and having it go out to all the servers and report on important security events and then mail it to me.
http://www.bindview.com/products/index.cfm

The MARs took care of a lot of this for us. Once it's installed and fine tuned... it's great. There were a lot of false positives out of the box... but what system doesn't?

We choose Cisco, in part, because we were moving towards a full cisco network.