[c-nsp] Providing 3rd party access to logs (syslog)

[Dale Shaw]

Hi all,

This may be a bit off topic, but I figure the cisco-nsp brains trust
will have "been there, done that" already.

Has anyone had a requirement to provide 3rd parties with access to log
files? I have a requirement to provide access to firewall log files
(syslogged) to a security group within an enterprise.

Logs held on the logging server will be sorted into a directory
hierarchy based on the logging device's name, year, date, day and then
severity (or something similar). They will likely be compressed.

I figure this could be as simple as setting up a web server on the log
server and enabling directory listings / browsing on the virtual
directories.

Has anyone come across a "nicer" solution? Perhaps something that
provides (for example) search capabilities and results filtering, and
real time log watching (ala "tail") through a web interface?

The log server OS has not been decided yet. It's likely to be Linux or
Windows Server.

cheers,
Dale