Blog Entries
What to do with all those logs?
The Italian Data Protection Authority requires the management and storage of millions of logs, but also outside Italy, a good log management strategy can provide several advantages. Some years ago, the Italian Data Protection Authority defined that the companies must register and store all data related to the system accesses performed by the administrators. This…
Read More[Update] Patch Released ! – LogManager (ex. SysLogView) zipping error of archived logfiles
To avoid a similar problem the next time change from winter to summer time ( i.e. CET to CEST ) a fix release has been published, backported for NetEye release 3.4. Update for NetEye 3.4 will be neteye-syslogview 2.1.9 Users of NetEye 3.5 will apply this fix together with other UI improvements and a better…
Read MoreRsyslog open FileHandler control with SyslogView 2.1.8
To keep the number of open TCP connections of the Log Auditing server under control, the SyslogView version 2.1.8 contains a control in the daily archiviation script, to check the number of currently open connections. This issue could be found in particular situations, where SAFED or other Audit agents might send across a routing device …
Read MoreNetEye: New MySQL Audit Plugin for SyslogView
In a standard MySQL setup, the logging of user logins/logouts is done by enabling the “general_log” logfile, which forces the MySQL process to log EVERYTHING. This can clearly produce bad performances under heavy load. To avoid such performance restrictions we added a new MySQL Audit Plugin to the Syslog View of NetEye.
Read MoreNetEye: Integration Logstash/Elasticsearch/Kibana
You probably already heard about Elasticsearch and its potential. Elasticsearch is a full-text search engine based on Lucene. It provides a RESTful web interface and schema-free JSON documents. To be able to better display logs collected by NetEye, we integrated three open source projects: Logstash, Elasticsearch and Kibana. Logstash parses logs and submits them to Elasticsearch, which saves them…
Read MoreUpdate of SyslogView 2.1.7 available
For the current NetEye 3.4 release, has been released an update of SyslogView. This version comes with these new features: Version 2.1.7: Add of new option -T to check_neteye_logManager.sh. This option check the TCP Socket 514 to be available on the local Rsyslog server For now it is better to make use of -T and…
Read MoreWindows process tracking with Safed
As well known, the Safed agent for Windows can collect events from the event log, filters them and forward the matched records to a centralized syslog server. There are some preconfigured set of events concerning basic activities that have to be tracked. The first one, and probably the most famous due to existing law conformity…
Read MoreSafed 1.6.7
The new version of Safed 1.6.7 comes with a new system administrator discovery executable based on .Net. This version is compatible with old version configurations ( < 1.6.5). Pay attention, the 1.6.6 version that came few days ago had had the same feature but when upgrading an old installation, the system admnistrator discovery configuration of…
Read MoreSyslogView: Windows Eventlog integration into the MessageConsole
The SyslogView module is the log and events collector for activities on remote hosts. Log messages or Eventlog entries of a Microsoft server are collected with this tool and stored for later auditing or search. A recent customer request was to make these incoming events more transparent for monitoring. What if the remote SAFED agent…
Read MoreSyslogView Fix release 2.0.8 – Search 1.2.6
– Added additional Syslog Agent definition for every supported operating system. Each additional definition is customizable and provides compatibility towards older versions of SAFED before 1.6 and possible custom port and communication settings. – FIX: The Syslog Search Statistic: ( configuration -> search ) is not showing the indexing statistic. – FIX: Syslog Search Statistic:…
Read MoreSyslogView Fix release 2.0.7
This release contains a minor fix in case the Rsyslog Server creates a log file without any content. This very uncommon situation was leading in the syslog – parser process to a warning – notified via email – that a zero division occurred since there are no rows of logs to parse. Details of the…
Read MoreSyslogView Fix release 2.0.6
A new SyslogView FIX version has been released to correct the centralized SAFED configuration parameter “number of cache files”.
Read MoreSyslogView Fix release 2.0.5
Fix release announcement for NetEye SyslogView and the SyslogView Search engine. SyslogView specific fixes: – Add a new SAFED nagios monitoring template. This can be used for an alternative SAFED configuration together with the main monitoring definition – Fix some JS DOM ID registrations – Add statistics regex to match “Eventlog corruption” SyslogView Search specific:…
Read MoreSyslogView Fix release 2.0.4
Fix release announcement for NetEye SyslogView and the SyslogView Search engine. SyslogView specific fixes: – FIX: Syslog Statistics: Regex filter selection box not shown in interface – FIX: Syslog Statistics: The statistic regex filters where not applied correctly on the row count of matching lines at the creation of statistics other than “general” – FIX: SyslogStore…
Read More