Log analysis software

Question

In order to learn more about what is logged by my desktop machine, I'd like to set up something better than a casual grep command to see what's going on. A typical use case would be to send an email with a warning if more than X SSH login attempts failed within Y minutes for user username.

To be clear, this is not for web server logs, which most *nix log analysis tools seem to be focusing on. Also, I would like this system to be live, not just a grep in cron, in order to be able to catch events like shutdown now before the machine goes down.

LogSurfer might be the right thing for me, but I'd like to know of other, similar tools if there are any.

Of course, I'm only interested in FLOSS.

rozcietrzewiacz · Accepted Answer · 2011-11-25T11:08:34.437

2

logwatch is a common solution for log analysing and monitoring
logsentry is also a classic package, targeted mainly at security

(Don't be put off by the lacks of shiny websites - many well-established, BSD-derived tools just aren't trying to promote themselves - it's enough for them to be known by experts.)

edited Nov 25 '11 at 11:08

answered Nov 25 '11 at 11:01

rozcietrzewiacz

39,269

Looks like logwatch is meant to be run "after the fact". Is it possible to plug this into the live syslog stream? – l0b0 Nov 25 '11 at 11:59
1

Looks like the Logcheck part of logsentry has moved; the SourceForge tarball is from 2003. – l0b0 Nov 25 '11 at 12:11
Looks like logcheck has to be run periodically, and can't run live because logtail doesn't take input from stdin. – l0b0 Nov 25 '11 at 12:22

score 1 · Answer 2 · answered Nov 25 '11 at 21:44

We use SEC at my current job. It's functionally similar to LogSurfer, in that it watches log files in real time ("tail -f" style), and it can act on any arbitrary event or combination of events. Like LogSurfer, you match the lines you're interested in using regular expressions, so you aren't limited to a particular log format.

Another one I ran across while looking for a link for SEC is LoGS. I've never seen or used it, but if you're in the evaluation stage, if might be worth a look, too.

Log analysis software

2 Answers2