Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

is there any free or open source tools that is able to collect audit logs from firewall in syslog format for monitoring purposes? There is 2 firewall in my organization and I would like to track changes done in the firewall by the administrator for compliance purposes.

Unfortunately there is budget constraints and we cannot afford to purchase SIEM solutions for this purpose.

Any tools or combination of tools that can achieve this objective is greatly welcomed.

share|improve this question

2 Answers

up vote 2 down vote

Fred,

Spunk would be perfect for this situation, it is free (if less that 500 mb of logs a day) and is easy to use.

download it here http://www.splunk.com/download

I hope this helps,

dc

share|improve this answer
I use Splunk and it works very well for this. – schroeder Apr 27 '12 at 2:00
With the reporting and graphing features, it is easy to turn Splunk into an SEIM. – schroeder Apr 27 '12 at 2:01
up vote 0 down vote

rsyslog, syslog-ng and even the venerable syslogd will aggregate logs from multiple sources. Certainly splunk provides some nice functionality for mining the data, but there are lots of other free tools about - logwatch, awstats (not just for web servers!), ossec, Adiscon log analyzer

for compliance purposes

That's often a cover phrase for "I don't know why I'm doing this". In which case, I'd recommend spending some time thinking about what information you can possibly get from these logs. It will better enable you to pick the right products and implement them effectively.

share|improve this answer
'compliance' in this case could simply mean they need to keep track of all changes using a system that the change agent cannot control, which an off-site log aggregator can do nicely. – schroeder Apr 27 '12 at 2:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.