Support
 
Support Get Quote
 
 
 
 

Auditing syslog device activities

Auditing syslog device activities

From switches to routers, almost all network devices generate syslogs. With so many syslog devices across your network, it takes a lot of time and effort to audit which includes tracking, monitoring, and analyzing all of them. However, regardless of how much effort these tasks take, your organization cannot afford to skip conducting a systematic review of these devices. Auditing helps you identify network security loopholes, tighten network security policies, increase network performance, and reduce system downtime. 

EventLog Analyzer takes the stress out of network device auditing by automatically collecting and analyzing syslog data from all network devices and generating audit reports for each one. EventLog Analyzer's audit reports are predefined and customizable, schedulable for automated delivery, available in multiple formats, and best of all, easy to comprehend. You can keep tabs on critical events that occur in your network by creating alerts that notify you in real time either via SMS or email.

Besides audit reports and real-time alerts, EventLog Analyzer also securely archives all syslog data for further use. When a security incident occurs, use the log search feature to drill down into specific incidents to backtrack the attack vector. Such forensic investigations help mitigate threats and proactively defend against further issues. EventLog Analyzer keeps you in the loop about all network activity in real time, keeping you in control of your network devices. Other benefits of auditing network devices using EventLog Analyzer include:

  • A centralized and customizable dashboard.
  • Predefined and customizable audit and compliance reports.
  • The ability to track critical events associated with account management, privileged user accounts, the network file system, and user logon and logoff activities.
  • Log archiving that is secure, encrypted, and flexible.
  • Real-time alerts for all critical events, sent via email or SMS.
  • Advanced log search options for performing log forensics.

EventLog Analyzer supports syslog data from all network devices, including Unix/Linux machines, VMware, IBM AS/400/iSeries machines, and computers running macOS. EventLog Analyzer offers more than 130 reports for all these devices, classified as follows:

Logon and logoff reports:

Monitor all user logon attempts and identify trends for successful or failed logons. See which users logged on as well as what logon method they used, including SSH, SU, FTP, and logons via remote devices.

User account management reports:

Review all user-based information to keep track of new, deleted, disabled, and renamed users and accounts as well as password modifications and user privilege levels changes. Keep tabs on critical objects and their activities to quickly detect security threats.

Unix mail server reports:

View all the information pertaining to a Unix mail server, such as received, sent, and rejected emails based on sender and remote devices. Audit the top recipients and senders for your mail server, email errors, failed deliveries, bad email addresses, and storage capacity. Keep track of your mail server's operations and all transactions happening within it. 

Unix FTP server reports:

Take a look at everything happening in your File Transfer Protocol (FTP) server with an FTP activity overview and information about uploaded and downloaded files, logins, connections, idle sessions, no-transfer timeouts, and FTP operations based on user and remote device. 

Unix threat reports:

Keep an eye on all the attacks your network is exposed to. Develop proactive measures by digging deep into these threat reports. Use these reports to identify reverse lookup errors, bad device configuration errors, bad ISP errors, and denial of service attacks.

Other Unix reports:

You can also generate additional predefined reports on various aspects of Unix machines. Some of the most commonly used reports are on:

  • Successful, denied, and refused NFS mounts based on users.
  • Successful and failed SUDO commands.
  • Removable USB connections.
  • Cron Job changes.
  • Deactivated services.
  • Connected and disconnected sessions.
  • Unprotected protocol versions.
  • Device name and address mismatch errors.

VMware server reports:

Obtain information on guest logins on VMs, created and deleted VMs, critical changes in VMs, and an overview of VM events. 

Severity, critical, and system reports:

  • Severity reports: Track events based on their severity (E.g. emergency, alert, critical, error, warning, notice, information, and debug).
  • Critical reports: Review all critical activities based on event, device, and remote device, with information on trends and overall activity.
  • System reports: View information on syslog services, disk-space capacity, yum updates, system shutdowns, ASP storage capacity, hardware errors, and system time updates.
Customer Speaks
  • Credit Union of Denver has been using EventLog Analyzer for more than four years for our internal user activity monitoring. EventLog Analyzer provides great value as a network forensic tool and for regulatory due diligence. This product can rapidly be scaled to meet our dynamic business needs.
     
    Benjamin Shumaker
    Vice President of IT / ISO
    Credit Union of Denver
  • The best thing, I like about the application, is the well structured GUI and the automated reports. This is a great help for network engineers to monitor all the devices in a single dashboard. The canned reports are a clever piece of work.
     
    Joseph Graziano, MCSE CCA VCP
    Senior Network Engineer
    Citadel
  • EventLog Analyzer has been a good event log reporting and alerting solution for our information technology needs. It minimizes the amount of time we spent on filtering through event logs and provides almost near real-time notification of administratively defined alerts.
     
    Joseph E. Veretto
    Operations Review Specialist
    Office of Information System
    Florida Department of Transportation
  • I love the alerts feature of the product. We are able to send immediate alerts based on pretty much anything we can think of. We send alerts when certain accounts login, or when groups are changed, etc. That has been very helpful. Also the automatic archive of the log files has been very helpful and has taken the worry out of keeping old logs. The “Ask Me” function is very nice as well. It is great to have some natural language queries built in where you can just click a button and get an answer.
     
    Jim Earnshaw
    Senior Computer Specialist
    Department of Chemistry
    University of Washington
  • Windows Event logs and device Syslogs are a real time synopsis of what is happening on a computer or network. EventLog Analyzer is an economical, functional and easy-to-utilize tool that allows me to know what is going on in the network by pushing alerts and reports, both in real time and scheduled. It is a premium software Intrusion Detection System application.
     
    Jim Lloyd
    Information Systems Manager
    First Mountain Bank

EventLog Analyzer Trusted By

A Single Pane of Glass for Comprehensive Threat Management