Just Thoughts

I came across this event management software EventTracker

It’s a solution to centralize all logs which I got from this article

There was another article, talking about utilizing Linux box to do the job

I’m not sure how to go about this, having zero knowledge about Linux. OK, does this OS come with an application that sorts out all the servers logs and events and manage them into a nice interface and reports! I’ll have to discover that

For now, I installed EventTracker on win2003 OS. You can add servers from the domain, it’s installs agents to retrieve the logs, you can configure it as agent-less but of course you won’t have all the features, I guess it’ll go with what SNMP provides which isn’t the whole purpose of my aim! Or maybe another approach, I’m still going through it.

Also, I have to enable more logging on the servers I added, not just user login/logoff events ;P that sort of thing. For example, on the file level, files added/modified/deleted.

You would thing there are many options out there, but I’ve searched a lot and the amount of info I’m collecting is very scarce, how are others centralizing their logs ???

And this product is quiet expensive! Need to explore more … we’ll see about the Linux thing

LOL, I found this in the second article, it’s pretty funny and well true

“But the truth is that admins typically don’t log routers and switches. When a problem occurs, we just reboot them or restart an interface, and then chalk it up to a hardware glitch.”

To be continued …