I like the idea of combination of send (sending to syslog aggregator) and fetch (fetching logs from clients) design.
(More in wonderful doc http://www.ranum.com/security/computer_security/archives/logging-notes.pdf)
However, if anybody uses this, what would be best tips to processes sucked logs?
Example: I would collect logs every hour. Normal send part works without problem. Then I would like to know:
- which log is in fetched part and not in already received (lost log message?)
- which log is not existing in fetched logs but presented in already received logs (modified logs on client?)
It would depend on how one manages logs on central log server, if using a correlation etc...
Inserting into a DB?