Posts Tagged ‘Snare’

Snare Agent For Windows

Snare is Windows application that collects eventlog and audit records and sends them to a centralized syslog server.

Snare is from InterSect Alliance.

There is both an enterprise (paid) version and a GPL/community version of Snare available.

Snare can be obtained from the product information page here.

There are a number of posts on this site regarding Snare.  You can find them by searching for posts tagged with Snare.

1 comment - What do you think?  Posted by admin - May 14, 2012 at 10:41 pm

Categories: Tools, Windows Tools   Tags: , ,

Windows Syslog

Windows does not natively support either sending logs out as syslog messages.  There are a number of applications that will translate Windows Event Logs to syslog.  A partial list is:

Why Send Event Logs To A Syslog Server?

There are a few good reasons to export Windows Event Logs as syslog messages.  Syslog is a basic format and allows logs from many sources to be normalized, stored in a central repository and analyzed by a common system.  Many log analysis engines support the direct pulling of Event Logs, but the mechanism to do so is generally pretty clumsy, requiring a batch process that periodically connects to a share and transfers a copy of the entire log file.  Such a process is inefficient if the log files are large, and does not provide the benefit of having the logs moved to a log sever/analyzer real time.  Logs sent to a separate log server are not at risk of being lost in the event of software or hardware failure or logical attack on the Windows server in question.


The primary down side to exporting Event Logs to syslog is that Event Logs are structured sets of data and the structure is not cleanly retained as the events are converted into a string of plain text.  Generally, though, it is possible to parse out the data with some rudimentary analysis of the converted log messages.

1 comment - What do you think?  Posted by admin - March 22, 2010 at 5:44 pm

Categories: Log Management, Windows   Tags: , , , ,

Configuring The Snare Windows Client And Syslog-NG To Work Together

In a previous post, we looked at installing Snare to log Windows events to a syslog server.  Here, we will configure syslog-ng to accept messages from Snare and implement a few simple customizations, including storing the logs in individual files.  We will assume that Snare is operational for the purposes of this guide.  Please see the post referenced above for help with installing Snare.

For this test, I am running syslog-ng 3.0.1 on FreeBSD 7.1 and Snare 3.14 on Windows XP.

First, we will start with a very basic configuration that logs to /var/log/messages:

source src {
destination messages { file(“/var/log/messages”); };

log {source(src); destination(messages);};

Read more…

4 comments - What do you think?  Posted by admin - May 13, 2009 at 7:57 pm

Categories: Logging, Windows   Tags: , ,

Logging Windows Events To Syslog Using Snare

There are now a bunch of commercial and open source agents that can run on a Windows system to take in Windows Event Logs and send them off to a syslog server.  We’ll be looking at the Snare agent in this post.

As of this writing, Snare is compatible with Windows NT, 2000, XP, 2003 and Vista.  There is also an agent available for 64 bit Windows versions.

For my test, I am installing on a Windows XP system.  Installation is quite straight forward.  There are MSI and scripted installers available on the Snare web site for large scale deployments.

The recommended installation has Snare taking control over the Event Log configuration, to synchronize the configurable logging “Objectives” in Snare with the Event Log settings.  Read more…

14 comments - What do you think?  Posted by admin - April 22, 2009 at 7:28 pm

Categories: Log Management, Logging, Security, Windows   Tags: , ,

Recent Posts in the Syslog Forum

RSS Error: A feed could not be found at A feed with an invalid mime type may fall victim to this error, or SimplePie was unable to auto-discover it.. Use force_feed() if you are certain this URL is a real feed.