Snare for Windows provides front end filtering, remote control, and remote distribution for Windows eventlog data
Snare for Windows is a Windows NT, Windows 2000, Windows XP, and Windows 2003 compatible service designed to interact with the underlying Windows Eventlog subsystem to facilitate remote, real-time transfer of event log information.
Snare is a program that facilitates the central collection and processing of
Windows NT/2000/XP/2003 Event Log information. All three primary event logs(Application, System and Security) are monitored, and the secondary logs (DNS, Active Directory, and File Replication) are monitored if available. Event information is converted to tab delimited text format, then delivered over UDP to a remote server.
Snare is currently configured to deliver audit information to a SYSLOG server
running on a remote (or local) machine. A configuration utility allows you to set the appropriate syslog target and priority, as well as the target DNS or IP address of the server that should receive the event information. It should be noted that many syslog servers are not designed to cope with the sorts of volume of data that multiple snare agents can potentially generate.
The Snare service will automatically start after you have completed the initial
configuration process. It is recommended that you configure each of your event logs to ‘overwrite as required’, as opposed to ‘overwrite > 7 days’, which is the default on Windows 2000 machines.
We also recommend that you configure appropriate access controls on the Snare registry entries using regedt32.exe – perhaps restricting the permission to read or modify the keys and values to Local or Domain Administrators only.
Snare stores it’s registry settings in: HKEY_LOCAL_MACHINESOFTWAREInterSect AllianceAuditService
Please remember that event monitoring is a complex area in most modern operating systems, and is not often very granular. Turning on significant event monitoring for a system can often produce unpredictable results, and could seriously detract from the resources available to the rest of your system or network.
We recommend that you have a good understanding of exactly what event information is going to be used for, proir to enabling event monitoring on your servers.
What’s New in This Release: [ read full changelog ]
ยท Updated exception handling to prevent application failures
See Demo – Download – Visit Author Site
Please comments and give ratings. You may also report of broken or incorrect link using comments box below. Thanks!