open source artificial ignorance-like systems

Chris Buechler <[email protected]>
Newsgroups gmane.comp.sysutils.loganalysis
Message-ID <[email protected]>
Likely everyone here has read MJR's artificial ignorance guide, but just 
in case you haven't:
http://www.ranum.com/security/computer_security/papers/ai/index.html

What I've spent a lot of time looking for, with no success, is an open 
source system that will implement something similar but smarter than a 
simple grep from cron. What I ideally want is something that reads logs 
in real time, and has a list of "rules", if you will, which would be a 
list of regex's with an action for each. Like always ignore xyz.*, 
ignore abcd.* unless it happens more than X times in Y time frame 
(minutes, hours), etc. and a default alert rule for anything that 
doesn't match any of the previous rules, since it's something I'm not 
expecting.

Seems pretty simple, but a lot of searching and browsing loganalysis.org 
and similar sites has left me with nothing. I could hack together 
something with standard Unix tools that would meet most of these 
requirements. But I figure as simple and useful as this is, somebody has 
probably already put together an open source package that does what I 
describe, I just can't find it.

Any suggestions would be appreciated. OS, if it matters, could be either 
FreeBSD or Linux.

Cheers,
Chris
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.