ColorLogs is an output-colorizing Perl script intended to have command output piped through it to a terminal. It allows easy creation of new highlighting configurations using simple text matches, globs, or regular expressions. It works transparently even in interactive contexts with scripts that produce prompt lines and wait for user input. Patterns are provided for Ant and Maven output. This version started as a fork of v1.1 from resentment.org, but numerous improvements have been made since then.
The Logfile Navigator, lnav for short, is a curses-based tool for viewing and analyzing log files. The value added by lnav over text viewers or editors is that it takes advantage of any semantic information that can be gleaned from the log file, such as timestamps and log levels. Using this extra semantic information, lnav can do things like interleaving messages from different files, generate histograms of messages over time, and provide hotkeys for navigating through the file. These features are meant to allow the user to quickly and efficiently focus on problems.
DenyThem is a program designed to protect your Linux system from malicious attacks. It is an active response system to disrupt and block dictionary attacks and DOS attacks. DenyThem by default uses /var/log/syslog and /var/log/auth.log and searches for hack attempts. When DenyThem finds enough hack attempts from a single host, it will add a DROP statement to your system's firewall, thus preventing future attacks. DenyThem uses iptables, so it will only work on Linux or any other system that uses iptables. It can also block traffic from specific countries.
The Subukan Sensor is a complete Network Intrusion Detection System (NIDS) platform. It is not simply an application one can install on an existing operating system. Rather, Subukan is a total software solution including both an operating system and a unique compilation of security tools. It is based on a single file image or firmware that transforms almost any hardware equipment into a fully functional NIDS appliance. Appliance- based technology simplifies administration and provides the capability for remote upgrades.
SiLK (System for Internet-Level Knowledge) consists of two sets of tools: a packing system and an analysis suite. The packing system receives Netflow V5 PDUs or IPFIX and converts them into a more space efficient format, recording the packed records into service-specific binary flat files. The analysis suite consists of tools that can read these flat files and then perform various query operations, ranging from per-record filtering to statistical analysis of groups of records. The analysis tools interoperate using pipes, allowing a user to develop a relatively sophisticated query from a simple beginning.
Logsend is a Unix daemon for email notification of log file changes, having 3 different backends. It watches the log files and periodically mails you the additions (being able to filter them). Logsend comes with a dialog-based configuration tool, as well as a live monitor that allows the users to watch the changes in real time.
Alerttail monitors a given file and executes a list of actions when a user-defined text pattern has been written to the file. For example, the user can pop up a GTK notification window when a certain message is written to a log file. Actions can be alerttail built in actions (GTK notify action, geoipLocalization action, or filtering text action) or a custom user defined shell command action. A Qt 4 GUI frontend helps with configuration.
hslogger is a logging framework for Haskell, roughly similar to Python's logging module. hpodder lets each log message have a priority and source be associated with it. The programmer can then define global handlers that route or filter messages based on the priority and source. hslogger also has a syslog handler built in.