1
vote

I'm helping to evaluate a couple of centralized log collection and reporting tools. To help in testing the tools, I'd like to be able to generate large numbers of simulated log messages. Preferably, I'd like to generate large quantities of logs that are formatted to appear to be valid logs for various devices like Unix servers, Windows servers, Cisco routers, etc.

Searching on Google, I found that there used to be a tool called Snare Generator that did this sort of thing, but it doesn't look like it's available anymore (the Snare website still has the documentation for Snare Generator, but I can't see where to download it).

Does anyone out there know of a good tool for generating lots of simulated log data? Or alternatively, do you know if it's still possible to get Snare Generator somewhere?

3 Answers 3

2
votes

I would suggest getting some samples from:

http://ossec.net/wiki/index.php/Log_Samples

They have logs from attacks, errors, failures, multiple devices, etc that you can throw against your tool to test.

2
votes

I don't know if this is what you want or not, but the logger command allows you to send any messages you want to the syslog system

1
  • I'm aware of logger, what I was hoping for is a way of generating log data that's formatted so that it looks like valid logs for specific devices. May 12, 2009 at 17:51
1
vote

Bearing in mind that I don't know why you require this, but something I would be asking would be what are you gaining by evaluating a system using 'random' data? You should really be evaluating the tools while they are experiencing as close as possible to the loads and data that it will be handling after going live. Otherwise it isn't a real evaluation.

As a suggestion, and assuming that you already have a collection of hosts that are logging to a syslog server, you could simply redirect the messages to the syslog server, as well as keeping the existing logs going. For standard syslogd, start the daemon with the -h flag and add a line to the beginning of your syslog.conf like this:

*.*    @loghost.example.com
1
  • The purpose is to know how much messages get lost, or at which load messages are getting lost. Also if you configured your logserver properly not to run out of space in case of massive amounts of messages. Testing prior to running the stuff is just a good practice. Just imagine you have some weird component that blocks if it can't submit to a log server and you find that out at Saturday 3AM when you phone wakes you up Jun 15, 2009 at 15:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .