Auditing syslog device activities

From switches to routers, almost all network devices generate syslogs. With so many syslog devices across your network, it takes a lot of time and effort to audit which includes tracking, monitoring, and analyzing all of them. However, regardless of how much effort these tasks take, your organization cannot afford to skip conducting a systematic review of these devices. Auditing helps you identify network security loopholes, tighten network security policies, increase network performance, and reduce system downtime. 

EventLog Analyzer takes the stress out of network device auditing by automatically collecting and analyzing syslog data from all network devices and generating audit reports for each one. EventLog Analyzer's audit reports are predefined and customizable, schedulable for automated delivery, available in multiple formats, and best of all, easy to comprehend. You can keep tabs on critical events that occur in your network by creating alerts that notify you in real time either via SMS or email.

Besides audit reports and real-time alerts, EventLog Analyzer also securely archives all syslog data for further use. When a security incident occurs, use the log search feature to drill down into specific incidents to backtrack the attack vector. Such forensic investigations help mitigate threats and proactively defend against further issues. EventLog Analyzer keeps you in the loop about all network activity in real time, keeping you in control of your network devices. Other benefits of auditing network devices using EventLog Analyzer include:

• A centralized and customizable dashboard.
• Predefined and customizable audit and compliance reports.
• The ability to track critical events associated with account management, privileged user accounts, the network file system, and user logon and logoff activities.
• Log archiving that is secure, encrypted, and flexible.
• Real-time alerts for all critical events, sent via email or SMS.
• Advanced log search options for performing log forensics.

EventLog Analyzer supports syslog data from all network devices, including Unix/Linux machines, VMware, IBM AS/400/iSeries machines, and computers running macOS. EventLog Analyzer offers more than 130 reports for all these devices, classified as follows:

Logon and logoff reports:

Monitor all user logon attempts and identify trends for successful or failed logons. See which users logged on as well as what logon method they used, including SSH, SU, FTP, and logons via remote devices.

User account management reports:

Review all user-based information to keep track of new, deleted, disabled, and renamed users and accounts as well as password modifications and user privilege levels changes. Keep tabs on critical objects and their activities to quickly detect security threats.

Unix mail server reports:

View all the information pertaining to a Unix mail server, such as received, sent, and rejected emails based on sender and remote devices. Audit the top recipients and senders for your mail server, email errors, failed deliveries, bad email addresses, and storage capacity. Keep track of your mail server's operations and all transactions happening within it. 

Unix FTP server reports:

Take a look at everything happening in your File Transfer Protocol (FTP) server with an FTP activity overview and information about uploaded and downloaded files, logins, connections, idle sessions, no-transfer timeouts, and FTP operations based on user and remote device. 

Unix threat reports:

Keep an eye on all the attacks your network is exposed to. Develop proactive measures by digging deep into these threat reports. Use these reports to identify reverse lookup errors, bad device configuration errors, bad ISP errors, and denial of service attacks.

Other Unix reports:

You can also generate additional predefined reports on various aspects of Unix machines. Some of the most commonly used reports are on:

• Successful, denied, and refused NFS mounts based on users.
• Successful and failed SUDO commands.
• Removable USB connections.
• Cron Job changes.
• Deactivated services.
• Connected and disconnected sessions.
• Unprotected protocol versions.
• Device name and address mismatch errors.

VMware server reports:

Obtain information on guest logins on VMs, created and deleted VMs, critical changes in VMs, and an overview of VM events. 

Severity, critical, and system reports:

• Severity reports: Track events based on their severity (E.g. emergency, alert, critical, error, warning, notice, information, and debug).
• Critical reports: Review all critical activities based on event, device, and remote device, with information on trends and overall activity.
• System reports: View information on syslog services, disk-space capacity, yum updates, system shutdowns, ASP storage capacity, hardware errors, and system time updates.