Joe
Sat Feb 17 15:51:10 CST 2007
I've never used splunk but I understand it to just be a data miner, it
will still require centralizing the logs.
Once you do that you also can look at logparser from MSFT.
joe
--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net
---O'Reilly Active Directory Third Edition now available---
http://www.joeware.net/win/ad3e.htm
Unsettled wrote:
> I've read through a few whitepapers from SANS about centralizing log
> files. One way was to install a syslog agent and forward it to a
> centralized syslog server. Another was to dump the event log to a file,
> and download it to a central box.
>
> Both those papers are not ancient, but also not very recent.
>
> Has anyone used splunk? I figure that would be a big time saver so i
> don't have to create my own frontend.