2

I have an application that logs app specific data to rotated log files. There are several servers doing their own logging, and I would like to aggregate these somehow into a central data store.

How is this typically done in Windows? How often should the aggregator service do its thing?

1 Answer 1

2

If you are referring to the Windows Event Log facility proper, there is a built-in capability to create subscriptions and designate specific machines as collectors. The subscriptions can be push or pull, and uses an XQuery/XPath syntax.

If you want to forward other types of data, you may want to look into Snare or some other Windows log mechanism. Snare has been around forever, there are agents and servers, and is open source:
http://www.intersectalliance.com/projects/index.html

If it is not a Windows event log, you may be interested in the "Epilog" Windows agent.

Frequency is dependent on requirements and available network resources. If everything is on a local LAN, network resources aren't as important. For the built-in Windows event forwarding, I would not collect events more often than 30 minutes, unless it is for an urgent security or financial purpose. Typically if the event log has not rolled over, events will not be missed. Snare is a different beast. I'm not sure of the scheduling or throttling capabilities. Our Snare agents are used for relaying security auditing information, so they are constantly streaming syslog data back to the collectors. Syslog is usually UDP, so this may not be as reliable as the Windows event subsystem for Windows security audit messages.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .