[ossec-list] Re: ossec and splunk

[Vincent Bernat <bernat@xxxxxxxx>]

OoO En cette  nuit striée d'éclairs du mardi 03  avril 2007, vers 02:26,
"Daniel Cid" <daniel.cid@xxxxxxxxx> disait:

> On Unix (and any operating system), when a process is listening on a specific
> port, no other process is allowed to use it. So, if you have ossec listening on
> port 514, splunk is not going to be able to use it. What you can do is disable
> remote syslog on ossec, enable your syslog server to receive remote messages
> and configure ossec and splunk to read from the files directly.

BTW, does someone know an open source alternative to Splunk ?
-- 
Indent to show the logical structure of a program.
            - The Elements of Programming Style (Kernighan & Plauger)