Good Windows event log analyzing/reporting tool?

Question

I'm looking for a Windows eventlog analyzing and monitoring software for Windows Server 2000/2003 (there are some new features in Windows Server 2008.) The feature set should include:

real-time monitoring (alerts via email or other messages)
definition of events/event groups which are watched
multiple-server
reporting (daily/weekly etc. reports)
nice client tools
not necessarily free or open-source, but that would be nice (of course)

Any recommendation or tip how to implement this using standard tools?

Thanks!

Shopping Questions are Off-Topic on any of the [se] sites. See [Q&A is hard, lets go Shopping](http://blog.stackoverflow.com/2010/11/qa-is-hard-lets-go-shopping) and the [FAQ] for more details. — Chris S, Aug 26 '12 at 04:08

score 5 · Accepted Answer · edited Jun 26 '12 at 10:51

5

I would suggest you use OSSEC. It can agregate all the information in a single server and has a nice web interface that allows you to display the alerts.

edited Jun 26 '12 at 10:51

mjn

933
2
12
26

answered May 29 '09 at 12:54

Antoine Benkemoun

7,314
3
41
60

score 3 · Answer 2 · answered May 29 '09 at 13:41

3

Zenoss Core...

answered May 29 '09 at 13:41

1

Here is a link: http://www.zenoss.com/product/network-monitoring – splattne May 29 '09 at 16:14
+1, specially if you setup an email alerting rule based on "Event Class Key" – l0c0b0x Jul 08 '09 at 20:31

score 2 · Answer 3 · answered Jul 08 '09 at 22:02

I use a set of custom Perl scripts. They do several things but the main one goes through the event logs of each of the servers, extracts the warnings and errors for the last 24 hours, creates an Excel spreadsheet with the results and puts that in a folder I check each morning. This way I get the interesting bits in an easy to read format.

I'm currently considering the practicality of integrating event log monitoring with Nagios. With the right kind of ignore filters (e.g. I really don't care that a print job failed) I should only receive alerts that need to be looked into. That's a fair bit of work to set up but I only need to do it once and it will make my job easier long term. Alternatively, I may have another look at Zenoss.

score 1 · Answer 4 · answered May 29 '09 at 13:37

I can recommend NOT using GFI event manager. It's a huge bandwidth hog (streams entire logs over the wire repeatedly) and if you have t1 remote sites, this is a big deal. Also, it's flaky, so it requires far too much upkeep for what should be a simple solution.

SecureWorks has a solution that we will be trying. It looks pretty good.

score 1 · Answer 5 · answered Jun 11 '09 at 19:26

1

Splunk (www.splunk.com)

answered Jun 11 '09 at 19:26

Noah Campbell

599
2
8
15

score 0 · Answer 6 · answered Jul 08 '09 at 20:25

0

Event Tracker http://www.prismmicrosys.com/eventTracker.php

answered Jul 08 '09 at 20:25

occam

11
1
4

Good Windows event log analyzing/reporting tool?

6 Answers6