3 ms·

Is echofish geared towards network activity norm / abnorm or general logs (syslog, app / dev logs, etc)? Sounds cool.

• rand0muid 12y ago
  Well, its approach (quoting its project page) is pretty simple: Echofish is a purpose-built solution for filtering & monitoring of syslog activity. By whitelisting regular messages through the web UI, the administrator can instruct the log processing mechanism to create alerts only for anomalies (irregular messages). ...and actually, it can do lots more once you read the built-in help (such as distribution (using BGP) of IP blacklists, consisting of IP addresses collected through syslog activity). TLDR; It's gearred towards filtering noise from logs. This also means you can possibly have another daemon reporting network activity through syslog, while echofish can act as your noise-filter.