Syslog Reporter/Analyser

Posted on 2010-01-08
Last Modified: 2013-11-16
Hi, I'm running Kiwi Syslogd to capture syslogs messages from a variety of sources, mostly routers, firewalls, and Windows servers (via SNARE).  

I'm dumping everything to a MS SQL 2000 database.  I'm looking for something that will connect to that database and do some reporting/analysis/etc type work - the more the better.  It'd also be nice to be able to search free text without writing a SQL query.

Anyone know of any good tools?  I've tested dozens and can't quite find what I'm looking for.  Only catch here is that it'd have to run on Windows.
Question by:entegration
    LVL 5

    Accepted Solution

    Have you tried Tableau? Looks like a very capable SQL analysis tool.
    LVL 60

    Assisted Solution

    I do not see that you really need a complex data mining services, if so you can see SQL Server Analysis Services @

    Natively there are the SQL query analyser, I believe you already tried and probably not what you looking for :)

    (1) One good tool I will propose is Splunk, it has great doc support and its feature would have satisfied what you wanted. But it actually get the log directly and perform on them, so to use it, you will need to do it indirectly - script to extract log and Splunk to index for further report/analyse on the existing SQL database, it will be achieved indirectly. See support
    - see doc
    - It probably satisfied the whole list of what you want.

    (2) Probably, you also want to take a look at Sphinx @
    I see Sphinx as an option if your full text search functionality isn't that complicated (Sphinx can't do partial matches or fuzzy search) or your indexed models don't change much. But note that it has free text search but no other features. MS SQL is also supported @

    (3) But the hard part is to do analysis tasks where typical human intervention is needed. There is one windows tool that will fit the bill. It is Logparser - MS tool (using SQL script but not for SQL database, it target XML, text files etc)

    You tell Log Parser what information you need and how you want it processed. The results of your query can be custom-formatted in text based output, or they can be persisted to more specialty targets like SQL, SYSLOG, or a chart.  Though it is still dependent on SQL query statement it can go granular,  parses out the logs to provide good insights.

    See this old (yet useful) article insights - doing forensic using LogParser. It does help to correlate but not in automated fashion. Human still the central engine to "join the dots" if that is the intent you see as priority @

    Featured Post

    How to run any project with ease

    Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
    - Combine task lists, docs, spreadsheets, and chat in one
    - View and edit from mobile/offline
    - Cut down on emails

    Join & Write a Comment

    Suggested Solutions

    OVERVIEW This guide provides information on the process performed when the Symantec Endpoint Protection (SEP) client checks in with the Symantec Endpoint Protection Manager (SEPM). AUDIENCE Information Technology personnel responsible for suppo…
    The foremost challenge encountered by an investigator at the very beginning of a forensics investigation is, accessing a file/data to read/view its contents. Owing to the fact, a platform is necessary for both; opening as well as examining any file.…
    It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
    Migrating to Microsoft Office 365 is becoming increasingly popular for organizations both large and small. If you have made the leap to Microsoft’s cloud platform, you know that you will need to create a corporate email signature for your Office 365…

    746 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    19 Experts available now in Live!

    Get 1:1 Help Now