Linux-based log analyzer for Windows system logs

Question

I want to turn my Raspberry Pi B+ into a log parsing and analysis server for my home network (currently 6 computers). For the Linux machines, this should not be too difficult with rsyslog and Logwatch or such.

The real problems though - and also the main reasons I want to do this - are the two Windows machines. One is Win7 x86, one Win10 x64. The Win7 box in particular is used for business stuff, so it's kind of important. If anything goes horribly wrong on those Windows machines, I want to know about it pronto.

Does any such software exist, that could

• Run on Linux

• Accept remote logs from Windows client machines

• Parse and analyze the logs

• Provide a summary to be emailed to me daily?

I feel like the obvious answer would be to use OSSEC, which has a client version for Windows. But I would prefer something a bit simpler in nature, more like Logwatch.

Answer 1

You could take a look at GRR Rapid Response - which is an incident response framework focused on remote live forensics

It consists of a server plus client installs and can give you a wealth of information about each machine that the client is installed on.

Since it is written in python it should be painless to install the server on Raspberry Pi and it can gather a wealth of data for each client machine.

I haven't yet found any components of it that are specifically for analysis of windows log files but I suspect that they are there somewhere & you can specify which data to gather to such a degree that they may be more or less redundant.

• Free
• Open Source
• Cross Platform
• Gathers all the forensic information you could desire
• e-mail problem reports

Answer 2

Pay attention:

Nagios is an open source program designed to monitor computer systems and networks: monitoring, controlling the state of computing nodes and services, notifying the administrator if any of the services stop working.

Zabbix is ​​a free system for monitoring the status of various computer network services, servers and network equipment, written by Alexey Vladyshev. MySQL, PostgreSQL, SQLite or Oracle Database are used to store data, the web interface is written in PHP. Supports several types of monitoring:

• Simple checks - can check the availability and response of standard services, such as SMTP or HTTP, without installing any software on the monitored host.
• Zabbix agent - can be installed on UNIX-like or Windows hosts to obtain data on processor load, network usage, disk space, etc.
• External check - execution of external programs, monitoring via SNMP is also supported.