Security log monitoring tool

Home Security Log Monitoring. Contact an Expert. Protect your organization from cyber attacks. Gain immediate visibility We help you achieve a deeper understanding of your security posture by applying a more strategic approach to threats and focusing on the most critical issues.

Continuous infrastructure monitoring The solution easily integrates with existing infrastructure including existing SIEM and log management devices using automation, so we can monitor all your devices, endpoints, systems and networks.

The flexibility to fit your needs Whether you want the service to fit into your existing security environment alongside alternative assessment tools or a stand-alone service, Lumen can accommodate you.

Features and Specs. Standard Features. Optional Features. Security Analytics: Access advanced search capabilities and extend threat detection visibility to the last 12 months, making low and slow attacks easier to recognize.

Threat Intelligence: Dig deeper into log data with intelligence from community feeds, social media searches, dark web searches, honey pot infection records and third-party research. As incidents are detected, our analysts will escalate them and provide transparent access to the same event console.

Cloud Security Monitoring: Get visibility into cloud environments and accounts, applying best-practice controls to cloud service configurations. Predictable, consumption-based pricing model-based on volume of security-related data transmitted per day, eliminating capital expense, administration and maintenance costs Flexible implementation models including comanaged and maintained by Lumen No implementation costs or licensing fees for log collection appliances.

Results from log record analysis can be made to trigger alerts, but these have to be processed by Nagios, or a Nagios-based monitoring system. Fluentd is an open-source project so that you can download the source code. This tool is free to use. The Fluentd website is the source for the program, and it is also the location of community pages where you can get help and advice on running the tool from other users.

The core package can be extended through plugins written by other community members. Those plugins are usually free of charge. You can use many other free interfaces as a front end for Fluentd, such as Kibana. Logstash is a log creation facility produced by Elastic. The core element of the Elastic Suite is Elasticsearch. This is a searching and sorting utility that can process data from several files into unified results. Elasticsearch can be integrated into other tools and is available for use with many of the other utilities in this list.

The functions of Logstash can be tailored to emulate Cronolog. The facility creates source files for analysis by other tools, such as Elasticsearch.

The power of this tool is that it can collate data from several different sources. The capabilities of Logstash include file parsing, so you can use this function to split up your log files by date. The output of Logstash can be formatted to suit a long list of utilities for analysis or display. It can also be written to a plain text file on disk, which is exactly what Cronolog used to do. Elastic produces Kibana, which is an excellent free front end for any data gathering tool.

The full capabilities of Kibana go way beyond the file parsing function of Cronolog. However, the full range of commands available with Kibana includes basic file management that can split out any log file by date. Kibana has a command language console that lets you create scripts and programs to process files.

The interface includes time-based analysis tools including filters, so you can quickly isolate records in a log file that relate to a specific date. Raw data, graphs, and other visualizations can be written out to files or used to generate reports. Standard reports can be scheduled to run periodically, so creating a filter by date and setting it to run daily and output to a plain text file would give you exactly the same results that you used to get from Cronolog.

The benefit of using Kibana is that it can give much more assistance than Cronolog could. You can compare data from different sources and visualize the information from all of your system log files to analyze performance and forecast capacity requirements. To get a full data management facility, you should probably use Logstash to collate source data, Elasticsearch to sort data, and Kibana to display results.

Kibana has plenty of data sourcing and manipulation facilities so that it could be used as a standalone data analysis tool. Graylog is a free, open-source log file-based system that can give you a lot more functionality than just a log archiving utility. This log management facility can work with any logs. You can feed data into it from other sources by channeling system reports into a file, thus creating your own logs.

Action scripts can forward log data to the screen, to other logs, or on to other applications. The dashboard shows data in the form of histograms, pie charts, line graphs, and color-coded lists. The interface includes a search and query function, which allows you to filter log records to get information on specific types of events or specific sources.

Those overall views of data are not your only option because you can drill down and see the detailed records that created a summary.

This makes Graylog a data mining tool. Alert conditions can be customized, and you can write actions to be performed in the event of alerts arising. These actions include executing scripts or notifying specific team members by email or by Slack message. This is an amazing and very comprehensive tool that can automate your log file processing and automatically execute fault resolution.

The two essential elements of Cronolog are that it could split up log files by date and that it could be run automatically. XpoLog includes both those functions. This is an excellent improvement on Cronolog, however, because XpoLog includes a lot of other functionality. It is a vast improvement on that discontinued log parsing tool. The utility can be installed on Mac OS X The log management software can also be installed on Linux Kernel 2.

Apart from straightforward log file management, the XpoLog analysis engine detects unauthorized file access and helps optimize application and hardware usage. XpoLog gathers data from selected sources and will monitor those files that you include in its scope. Once data is centralized, XpoLog merges all data sources and creates its own database of records. Those records can be searched and filtered for analysis, and results can be written out to files. That functionality offers the same file parsing as Cronolog.

Results can be written out to files or retained as archives for viewing through the XpoLog dashboard. XpoLog is available for free. If you just want to split up your Apache log files, then the free version will be good enough. To deal with larger volumes of data and employ the system for analysis, then you might have to step up to one of the paid plans. The free version allows you to process up to 1 GB of data per day, and the system will retain that data for five days.

You could always write out the records to text files to get around that five day limit. You get progressively larger daily data throughput allowances at each price point. You have to pay for the service annually in advance, even though it has a monthly price. You can also buy a perpetual license.

The program is specifically designed to manage Apache web server logs. Managelogs has different operating modes activated by the variables specified when launching the program. You can set the utility to archive log files by date , or you can specify a maximum file size, which will copy over the log file to a new name and then clear out the current log file so it can start again from scratch and build up new records. Although there are plenty of clever things you can do with regular expressions and pattern matching to pick out records for a specific date, the easiest way to get log archives per day is to write a copy script and then schedule it to run at midnight.

If the last instructions in the script remove the existing file, new records will accumulate in a separate file throughout the day, to be archived off again at midnight. Cronolog was not that great, and you could quite easily write your own version in just a couple of minutes. Log management utilities are very useful and despite the limited capabilities of Cronolog, many systems administrators came to rely on its services. Every one of the recommendations in our list of Cronolog replacements can be used or tried for free.

All of these facilities give you better service than the do-it-yourself replication of Cronolog. Try out any of these tools and see which of them gives you the extra features needed to improve log and facilities management. Log aggregation combines log files from different sources so that they can be unified for analysis. Different logging systems deploy individual file formats, so log aggregators need to convert log file contents into a unified format.

Once all files have the same record layout, they can be submitted together to analytical tools for sorting, searching, filtering, and summarizing. One of the main sources of application logs is the Windows Event system. These are very easy to collect in Windows environments.

Log files and event messages get generated by most applications and operating systems but most people ignore them. You can get a lot of information about the operations of your IT infrastructure if you pay attention to these messages and if you want security standard accreditation, you need to have a comprehensive log management policy. Centralized log management requires you to collect all log files and store them in one place. Many businesses use cloud storage for this activity. Aggregating logs for analysis is also a good idea.

A log management plan needs a strategy. You need to grade the log message sources in order of importance. Next, all log files need to be standardized and stored centrally. A log file analyzer will help you to get useful information from your logs.

Look for a log managing package that will support all of these log management activities. I suggest you to add Motadata log management in your list. This site uses Akismet to reduce spam.

Learn how your comment data is processed. Comparitech uses cookies. More info. Menu Close. We are reader supported and may receive a commission when you make purchases using the links on our site. We show you which log management tools you can start using for free today. Stephen Cooper. This system also offers an archive manager and you can choose whether to bundle in a storage package or store to your own cloud account. You can also send live network monitoring data into Kibana to identify traffic anomalies.

Download link: Get a day free trial :. Sematext Free Trial. It handles text based log dumps, event logs, remote logging, and even event and remote event channels as well! The free version has much of the same features as the licensed versions, but many of the convenience and ease-of-use features are locked from free, such as search-as-you-type filtering, customizable columns, tabbed interface, and other more quality-of-life based functionality.

The Netwrix Event Log Manager can be considered a simpler and light version of their Auditor software. The Log Manager is freeware and handles all the basic needs such as consolidation of events from an entire network in a single place for review, real-time e-mail alerting of critical events, some limited amount of alert criteria filtering, and some archiving ability limited to one month.

A larger network of systems or one where security and prompt alerting are key would have a hard time getting by on the freeware version alone, however.

Price: Freeware, Netwrix also has a trial for a more robust Auditor software for event logs. Splunk is a log management program which does a great job encapsulating data from an entire range of devices across a network.

It also has the ability to be expanded via add-ons and plugin apps to increase its already powerful core functionality!

However, the product line also includes a less-well-known log file manager, called the Log Management Suite, which installs on Windows Server. It captures Event logs as they circulate around the system and stores them in rotated files held in a meaningful directory structure. The service also acts as a Syslog server and it is capable of managing IIS log messages as well.

In addition to its capture and log file creation capabilities, the Log Management Suite can archive, restore, and protect log files. The suite includes a file viewer that has sorting, grouping, and filtering abilities to support analysis. The pack includes pre-written report formats that can be applied to log data stores. Contact the Sales team for a quote. TripWire's Log Center is focused more on the security-minded with tools that excel at identifying and responding to threats while swiftly assuring that all devices and traffic meet proper compliance, even for the most strict regulatory needs!

This software is less of an all encompassing tool and is more of a precision one for making sure that your environment is compliant and secure, and helps assure that by merit of extensive backup and protection features on top of log management and analysis. InTrust's aim is to help make managing large amounts of information in a broad environment easier and, ultimately, cheaper as well.

It helps reduce storage and data management costs with intelligent compression and also has excellent features for auditing security practices to be certain regulatory needs are met. Previously under the monikers of SpectorSoft andVeriato's Server Manager, Corner Bowl Server Manager is a very cost effective tool, even at the enterprise level, that still offers much of the same power and versatility as some of the other options. It has a centralized management console for disk monitoring, log management, reporting and alerts.

LogRhythm is a program that beautifully marries management of logs and events into a single smooth interface. It handles the gathering of log data from applications and databases alike from all sources available and even has automated archival and retrieval for searching.

A great deal of the management aspect is fully automated, though still able to be manually adjusted as needed. SumoLogic is somewhat unique in that it is a primarily cloud-based tool, which means that access need not be restricted by availability of a particular system or operating environment, and grants a great deal more freedom for a technician often traveling.

One of its more unique features is that forensics are run as separate threads which can help to spread and isolate resource use in cloud space. Lastly, SumoLogic is intelligently segmented, meaning it's incredibly easy to add, and remove, whatever is necessary to have the perfect sized solution for supporting your environment without wasting resources.

EventTracker's Log Manager goes beyond Windows and server logs and encompasses everything it can grab — Linux, Unix, Syslog, and Windows logs , which is goes deeper into than other programs by grabbing all the Security, Application, and Error logs for analysis. All of this ties up neatly with a powerful visual front end which fits perfectly the technician who works better with an interface littered with intuitive graphs and charts.

Logscape is a somewhat specialized tool but it makes up for that by merit of being quite powerful. It has almost unlimited ability to visualize, analyze, and search log information of nearly any size, which is something that other programs start to slow down or balk at the prospect of doing!

It's front-end is heavily customizable to make it easier to quickly glimpse the information that is only most pertinent to your needs.