Currently I have a fairly large syslog-ng cluster setup that is my main log aggregation point. I have the need to be able to acknowledge certain logs and mark them as review for auditing purposes. Such as all failed sudo attempts. I can easily send the logs I am interested in to a specific folder, program, or email, but was wondering what you all use for the auditing aspect of it. Currently I send them to a MySQL DB and have it where it shows the logs and I can click acknowledge and add comments if I like. While this method works, I wanted something a little more professional looking. I've thought about tying them into an open source ticketing system and closing them out after review but wanted others opinions.
Thanks,
Eric