syslog server Piergiorgio Venuti

New service | Log Management – High performance service for collecting logs

syslog server – High performance service for collecting logs

    • Use all the strengths of the syslog-ng Premium Edition
    • Find logs, secure sensitive data with granular access policies and generate reports
    • Forward logs to third-party tools

 

SYSLOG SERVER – CLOUD LOG MANAGEMENT SERVICE TO MANAGE YOUR LOGS

Log Management service allows you to keep logs (applications, system, audit logs, query databases, etc) in the Secure Online Desktop Cloud secure from any tampering with respect to data retention rules.

COLLECT AND INDEX LOG DATA IN CLOUD

Log Management service uses the syslog-ng Premium Edition as log collection agents which provide highly scalable and reliable log collection. Installers are available for 50+ platforms, including the most popular Linux distributions, commercial versions of UNIX and Windows.
The indexing engine is optimized for performance. Depending on its exact configuration, one syslog-ng Store Box can collect and index up to 100,000 messages per second for sustained periods. A single Log Management instance can collect log messages from more than 5,000 log sources. When deployed in a client-relay configuration, a single Log Collector can collect logs from tens of thousands of log sources

SEARCH, TROUBLESHOOT, AND REPORT

With full-text search, you can search through billions of logs in seconds via the intuitive web-based user interface. Wildcards and Boolean operators allow you to perform complex searches and drill down on the results. Users can gain a quick overview and pinpoint problems. Users can easily create customized reports from the charts and statistics they create on the search interface to demonstrate compliance with standards and regulations such as PCI-DSS, ISO 27001, SOX and HIPAA.

HIGHLY SCALABLE INDEXING ENGINE

The Log Management service is optimized for performance, and can handle enormous amounts of messages. Depending on its exact configuration, it can index over 100,000 messages per second for sustained periods and process over 70 GB of raw logs per hour.

syslog server – REAL-TIME LOG DATA TRANSFORMATION

Filter, Parse, Re-Write

The syslog-ng application can sort the incoming log messages based on their content and various parameters like the source host, application, and priority. Directories, files, and database tables can be created dynamically using macros. Complex filtering using regular expressions and boolean operators offers almost unlimited flexibility to forward only the important log messages to the selected destinations

Parse key-value pairs

Log Aggregator can separate a message consisting of whitespace or comma-separated key-value pairs (for example firewall logs) into name-value pairs.

Parse sudo log messages

Privileged user accounts represent the highest security risk, as they allow access to the most sensitive data and resources. The sudo parser enables you to enrich your log message data with details of privilege escalation events.

Normalize data with PatternDB

The syslog-ng application can compare the contents of the log messages to a database of predefined message patterns.

Real-time log message classification

By comparing log messages to known patterns, syslog-ng is able to identify the exact type of the messages, and sort them into message classes. The message classes can be used to classify the type of the event described in the log message. The message classes can be customized, and, for example, can label the messages as user login, application crash, file transfer, etc.

Extracting important information from messages

In addition to classifying messages, you can also add different tags which can be used later for filtering messages, for example, to collect messages tagged as user_login to a separate file or to perform conditional post processing on the tagged messages.

Real-time event correlation

Syslog-ng also makes real-time event correlation possible. This can be useful in many different situations. For example, important data for a single event is often scattered into multiple syslog messages. Also, login and logout events are often logged far away from each other, even in different log files, making log analysis difficult. Using correlation these can be collected into a single new message.

 

syslog server – AUTOMATED BACKUP OF STORED DATA

Stored log messages and the configuration of SSB can be periodically transferred to a remote server using the following protocols
:

– Network File System protocol (NFS);
– Rsync over SSH;
– Server Message Block protocol (SMB/CIFS).

Share


RSS

More Articles…

Categories …

Tags

RSS Unknown Feed

RSS Full Disclosure

  • Unauthenticated Blind SQL Injection | RSI queue management system - V 3.0 | CVE-2025-26086 May 17, 2025
    Posted by Shaikh Shahnawaz on May 16[+] Credits: Shahnawaz Shaikh, Security Researcher at Cybergate Defense LLC [+] twitter.com/_striv3r_ [Vendor of Product] RSI Queue (https://www.rsiqueue.com/) [Vulnerability Type] Blind SQL Injection [Affected Component] The vulnerable component is the TaskID parameter in the get request. [CVE Reference] CVE-2025-26086 [Security Issue] An unauthenticated blind SQL injection vulnerability exists in […]
  • CVE-2025-30072 Tiiwee X1 Alarm System - Authentication Bypass by Capture-replay May 17, 2025
    Posted by Sebastian Auwärter via Fulldisclosure on May 16Advisory ID: SYSS-2025-006 Product: Tiiwee X1 Alarm System Manufacturer: Tiiwee B.V. Affected Version(s): TWX1HAKV2 Tested Version(s): TWX1HAKV2 Vulnerability Type: Authentication Bypass by Capture-replay (CWE-294) Risk Level: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N Solution Status: Open Manufacturer Notification: 2025-01-27...
  • SEC Consult SA-20250506-0 :: Honeywell MB Secure Authenticated Command Injection May 17, 2025
    Posted by SEC Consult Vulnerability Lab via Fulldisclosure on May 16SEC Consult Vulnerability Lab Security Advisory < 20250507-0 > ======================================================================= title: Authenticated Command Injection product: Honeywell MB-Secure vulnerable version: MB-Secure versions from V11.04 and prior to V12.53, MB-Secure PRO versions from V01.06 and prior to V03.09 fixed version: MB-Secure v12.53, MB-Secure PRO v03.09 CVE number:...
  • SEC Consult SA-20250429-0 :: Multiple Vulnerabilities in HP Wolf Security Controller and more May 17, 2025
    Posted by SEC Consult Vulnerability Lab via Fulldisclosure on May 16SEC Consult Vulnerability Lab Security Advisory < publishing date 20250429-0 > Combined Security Advisory for Sure Access Enterprise and Sure Click Enterprise ======================================================================= title: Multiple Vulnerabilities product: HP Wolf Security Controller / HP Sure Access Enterprise / HP Sure Click Enterprise vulnerable version: HP Wolf […]
  • SEC Consult SA-20250422-0:: Local Privilege Escalation via DLL Search Order Hijacking May 17, 2025
    Posted by SEC Consult Vulnerability Lab via Fulldisclosure on May 16SEC Consult Vulnerability Lab Security Advisory < 20250422-0 > ======================================================================= title: Local Privilege Escalation via DLL Search Order Hijacking product: Ivanti Endpoint Manager Security Scan (Vulscan) Self Update vulnerable version: EPM 2022 SU6 and previous, EPM 2024 fixed version: EPM 2022 SU7 and EPM 2024 […]
  • Session Invalidation in Economizzer Allows Unauthorized Access After Logout May 17, 2025
    Posted by Ron E on May 16A session management vulnerability exists in gugoan&apos;s Economizzer v.0.9-beta1. The application fails to properly invalidate user sessions upon logout or other session termination events. As a result, a valid session remains active and usable even after the user has attempted to log out. POST /web/category/create HTTP/2 Host: Cookie: _economizzerSessionId=;
  • Persistent Cross-Site Scripting in Economizzer Category Entry May 17, 2025
    Posted by Ron E on May 16A persistent cross-site scripting (XSS) vulnerability exists in gugoan&apos;s Economizzer v.0.9-beta1. The application fails to properly sanitize user-supplied input when creating a new category via the *category/create *endpoint. An attacker can inject malicious JavaScript payloads that are permanently stored and later executed in the context of any user who […]
  • Persistent Cross-Site Scripting in Economizzer Cashbook Entry May 17, 2025
    Posted by Ron E on May 16A persistent cross-site scripting (XSS) vulnerability exists in gugoan&apos;s Economizzer v.0.9-beta1 The application fails to properly sanitize user-supplied input when creating a new cash book entry via the *cashbook/create* endpoint. An attacker can inject malicious JavaScript payloads that are permanently stored and later executed in the context of any […]
  • APPLE-SA-05-12-2025-9 Safari 18.5 May 17, 2025
    Posted by Apple Product Security via Fulldisclosure on May 16APPLE-SA-05-12-2025-9 Safari 18.5 Safari 18.5 addresses the following issues. Information about the security content is also available at https://support.apple.com/122719. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. WebKit Available for: macOS Ventura and macOS Sonoma Impact: A type […]
  • APPLE-SA-05-12-2025-8 visionOS 2.5 May 17, 2025
    Posted by Apple Product Security via Fulldisclosure on May 16APPLE-SA-05-12-2025-8 visionOS 2.5 visionOS 2.5 addresses the following issues. Information about the security content is also available at https://support.apple.com/122721. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. AppleJPEG Available for: Apple Vision Pro Impact: Processing a maliciously crafted […]

Customers

Newsletter

{subscription_form_1}