6

I want to turn my Raspberry Pi B+ into a log parsing and analysis server for my home network (currently 6 computers). For the Linux machines, this should not be too difficult with rsyslog and Logwatch or such.

The real problems though - and also the main reasons I want to do this - are the two Windows machines. One is Win7 x86, one Win10 x64. The Win7 box in particular is used for business stuff, so it's kind of important. If anything goes horribly wrong on those Windows machines, I want to know about it pronto.

Does any such software exist, that could

  • Run on Linux

  • Accept remote logs from Windows client machines

  • Parse and analyze the logs

  • Provide a summary to be emailed to me daily?

I feel like the obvious answer would be to use OSSEC, which has a client version for Windows. But I would prefer something a bit simpler in nature, more like Logwatch.

2
  • What logs do you get from the Windows machine? Is it plain text or do you export the Windows Event Log as XML or CSV? Jan 8, 2016 at 13:57
  • You could investigate what Powershell Core can do for you. There is no Get-Eventlog commandlet at this time (Aug 2019) but you can connect to Windows hosts with Remoting and run the command there.
    – knb
    Aug 25, 2019 at 10:49

1 Answer 1

0

You could take a look at GRR Rapid Response - which is an incident response framework focused on remote live forensics

It consists of a server plus client installs and can give you a wealth of information about each machine that the client is installed on.

Since it is written in python it should be painless to install the server on Raspberry Pi and it can gather a wealth of data for each client machine.

I haven't yet found any components of it that are specifically for analysis of windows log files but I suspect that they are there somewhere & you can specify which data to gather to such a degree that they may be more or less redundant.

  • Free
  • Open Source
  • Cross Platform
  • Gathers all the forensic information you could desire
  • e-mail problem reports

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.