Re: centralizing logs

On Thu, 2004-03-11 at 20:44, dcneting wrote:
> is there any tool(open source/commercial) that can be use to centralized
> every log into 1 database? Im using a lot of tools here like ethereal,
> tcpdump,snort..bla bla bla...so, it is hard for me to see the log one by
> one...

The IDMEF proposed standard (latest version available at
ftp://ftp.ietf.org/internet-drafts/draft-ietf-idwg-idmef-xml-11.txt) is
the work to create such a integration.

So far I only know of Prelude (http://www.prelude-ids.org) that actually
using it against a database, but there are other tools using IDMEF as
means to report events.

-- 
Michael Boman