Repository files navigation

Central syslog management console with whitelisting feature and ability togenerate events from syslog entries.

Echofish is a web based real-time event log aggregation, monitoring andmanagement system, developed in php and mysql, with functionality based on theexcellent idea/paper ofMarcus J. Ranum, "Artificial Ignorance".

Through a simple dashboard, Echofish provides a single view for theadministrators to monitor system and application events. Echofish allows thecreation of whitelists and filters to provide administrators with a unique andcustomized view of their systems' event messages. Through detailed reports,alerting and notifications, Echofish is able to deliver new levels ofvisibility and insight on your business IT infrastructure.

Echofish focuses around the fact that:

• daily operators need to be able to see what happens on their network.
• syslog messages are events that need to be addressed.
• similar events don't need to be addressed separately.
• there is no need to be worried about events that are known to be good(whitelisted).
• once all the whitelisted entries are gone, we are left with mostly importantmessages that need our attention.

When a message is received by syslog it gets written into a specific table ofthe echofish database.

Upon INSERT on that table, special triggers and events take over, in order toinspect the message parameters and decide -based on your rules- whether themessage is worthy of your attention or it needs to be discarded.

On top of that, you can create triggers that allow you to achieve certainexplicit tasks such as:

• After 10 failed ssh logins issue a syslog warning about brute forceattempt and report the attacker's IP
• Ifuser@example.com usually logs from 1.2.3.x network and now he'sappearing from Korea notify me
• Issue an alert if the ssh logins on the servers are not from the admin's IP

You can find configuration samples, installation recipes and other usefullinformation in thecontrib/ folder.