Does anyone have any experiance with proactive log monitoring software?

Question

I do not have much experience in this area but want to have something that monitors logs so I can be more proactive. In my company (like most) i wear many hats and do not get the opportunity to review system logs unless there is an issue.
I am looking for a tight budget solution.
thanks for any help!
Message was edited by: cpguru21

Answer 1

The problem with watching logs is that you kind of need to know what you're looking for before you can implement any kind of worthwhile automated/proactive log analysis. You might find your server logs thousands of benign log messages a day but that doesn't mean you need to action (or even be aware) of any of them.
Even if there are messages you care about, you might only care once a threshold has been reached, and learning the thresholds (both count and duration) is a learning element in itself.
The ultimate tool for this is probably Splunk, and the price is right (free for limited use up to 50MB of log messages per day), but don't expect to install it and be done - it will take time to teach Splunk about which log files to read, what events in those logs to worry about, what thresholds to cross and what actions to take.