Lately I have been fiddling around with PHPlogcon. I wanted to consolidate logs from our servers on a single machine, which is a breeze to set up using any standard Linux syslog daemon. Furthermore I wanted a graphical front-end (a website is just fine) to enable access to the logs for the not-so-linux-savvy admins. So PHPlogcon fit the bill perfectly. It supports flat-file logs (yay) and even MySQL.

The Windows servers need an additional piece of software to get it to forward the “Eventlog” messages. The default “Windows Eventlog parser” which is shipped with PHPlogcon only works with a proprietary Windows Eventlog forwarders (Adiscon’s EventReporter and MonitorWare Agent), so I wrote my own parser for the Open Source SNARE Eventlog Agent. (sourceforge)

Just put the parser in classes/msgparsers/msgparser.eventlogsnare.class.php and add something like the this to your configuration file and you are done:

$CFG['Sources']['Source5']['ID'] = 'Source5';
$CFG['Sources']['Source5']['Name'] = 'EventLog';
$CFG['Sources']['Source5']['ViewID'] = 'EVTRPT';
$CFG['Sources']['Source5']['SourceType'] = SOURCE_DISK;
$CFG['Sources']['Source5']['MsgParserList'] = "eventlogsnare";
$CFG['Sources']['Source5']['LogLineType'] = 'winsyslog';
$CFG['Sources']['Source5']['DiskFile'] = '/var/log/win_eventlog.log';