Re: Analyzing tons of logs

"Bamm Visscher" <[email protected]>
Newsgroups gmane.comp.sysutils.loganalysis
Message-ID <[email protected]>
I am always interested in feedback on how Sguil scales (both good and
bad).  I am aware of a few implementations with sensors in high speed
environments and in my experience, those environments require more
care and feeding, but people seem to be doing it. As far as total
number of sensors, the largest implementation I am aware of is ~25
sensors.  I personally have seven sensors reporting to a central Sguil
server. The sensors are at ingress/egress points on the network the
most utilized being a 40MB internet link. The sensor has 650GB
dedicated to pcap logging and I can keep around ten days worth of raw
pcap on it. The Sguil server currently has around 11 million rows of
Snort alerts and close to 1 billion rows of SANCP (flow/session) data.

I wouldn't say Sguil is focused on Snort as much as it is on NSM. NSM
a network centric way to do security monitoring and Snort is the Sguil
supported way to gather event/alert data. I am getting ready to
release a new version and it will have the ability to receive generic
events from other data sources (it's not perfect, but should be
usable).

Always glad to hear there are fans :)

Bammkkkk

On 3/29/07, James Turnbull <[email protected]> wrote:
> On Fri, 30 Mar 2007 08:57:33 +0530, "Chetan Gupta" <[email protected]> wrote:
>
> > How about sguil? Thats an NSM tool I guess. Has any one tried it?
>
> I am a fan of sguil - it's powerful and well designed (IMHO) but I am not sure it will scale to meet your requirements.  It's also primarily focussed on IDS (principally Snort) data.  You'd need to customize it to deal with some other kinds of data.
>
> Regards
>
> James Turnbull
>
> _______________________________________________
> LogAnalysis mailing list
> [email protected]
> http://www.loganalysis.org/mailman/listinfo/loganalysis
>


-- 
sguil - The Analyst Console for NSM
http://sguil.sf.net
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.