0
votes
0answers
103 views

EventLog/Syslog to Common Event Format

I am looking for a way to get EventLog/Syslog to Common Event Format (CEF)? And also looking for a way to forward the CEF events through a Syslog-ng type of forwarder within the environment. I have ...
0
votes
1answer
447 views

Cisco Nexus syslog messages format?

I'm trying to normalize Syslog messages generated by a Cisco Nexus box. Problem: Messages have the following format: <189>: yyyy mm dd hh:mm:ss UTC: text This is not a standard Syslog message, no ...
2
votes
2answers
1k views

Forward Windows Events Logs to Rsyslog

I would like to forward Windows Events Logs from all my desktop clients to a Linux box with rsyslog on. Rsyslog provide a Windows agent to do just that but its 40 euros per license and when you have ...
2
votes
2answers
853 views

How to control/check CheckPoint rules changes (and another System events)

I need to check/control all system events on many CheckPoint FW1 - don't misunderstand - not rules triggering, but events such admins log on, rules changes and etc. I found out that I can make an log ...
4
votes
5answers
1k views

Forwarding Windows log event using TCP

I'm looking for a way to safely centralize all my Windows and Linux logs on one location. Since I'm in a mixed environment, with both Linux and Windows, I started using Syslog-ng on the Linux boxes ...
2
votes
3answers
2k views

Turn Windows Event Logs EVT files into Syslog to send to LogLogic

I have a a requirement to analyze 13gb of Windows logs by feeding it into a LogLogic Log aggregator. LogLogic is essentially Linux Syslog server, it can take a Syslog (Tcp/udp 514) feed or log on to ...
5
votes
2answers
18k views

How can I ship Windows Server 2008 event logs to a syslog server?

In the past with Windows Server 2003 I was able to ship the event logs to a central network syslog server using evtsys (https://engineering.purdue.edu/ECN/Resources/Documents/UNIX/evtsys). It does not ...